From 661d3d28e97bb49bef075c0314edad5879148aaa Mon Sep 17 00:00:00 2001 From: Gusted Date: Sun, 16 Jan 2022 05:14:32 +0000 Subject: Prevent possible XSS when using jQuery (#18289) In the case of misuse or misunderstanding from a developer whereby, if `sel` can receive user-controlled data, jQuery `$(sel)` can lead to the creation of a new element. Current usage is using hard-coded selectors in the templates, but nobody prevents that from expanding to user-controlled somehow. --- web_src/js/components/RepoBranchTagDropdown.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'web_src/js/components') diff --git a/web_src/js/components/RepoBranchTagDropdown.js b/web_src/js/components/RepoBranchTagDropdown.js index 50c71d5bac..2b260e9399 100644 --- a/web_src/js/components/RepoBranchTagDropdown.js +++ b/web_src/js/components/RepoBranchTagDropdown.js @@ -2,7 +2,7 @@ import Vue from 'vue'; import {vueDelimiters} from './VueComponentLoader.js'; export function initRepoBranchTagDropdown(selector) { - $(selector).each(function () { + $.find(selector).each(function () { const $dropdown = $(this); const $data = $dropdown.find('.data'); const data = { -- cgit v1.2.3