From f9b4efd42c17d7f75b689142b17575a478fe903c Mon Sep 17 00:00:00 2001 From: Yarden Shoham Date: Sat, 16 Mar 2024 15:25:27 +0200 Subject: Forbid HTML injection using jQuery (#29843) See https://github.com/wikimedia/eslint-plugin-no-jquery/blob/master/docs/rules/no-append-html.md Tested the following components and they work as before: - notification table - issue author dropdown - comment edit box attachments div Signed-off-by: Yarden Shoham Co-authored-by: Giteabot --- web_src/js/modules/fomantic/dropdown.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'web_src/js/modules') diff --git a/web_src/js/modules/fomantic/dropdown.js b/web_src/js/modules/fomantic/dropdown.js index caba8a2f28..7302078dbd 100644 --- a/web_src/js/modules/fomantic/dropdown.js +++ b/web_src/js/modules/fomantic/dropdown.js @@ -72,7 +72,9 @@ function delegateOne($dropdown) { dropdownTemplates.menu = function(response, fields, preserveHTML, className) { // when the dropdown menu items are loaded from AJAX requests, the items are created dynamically const menuItems = dropdownTemplatesMenuOld(response, fields, preserveHTML, className); - const $wrapper = $('
').append(menuItems); + const div = document.createElement('div'); + div.innerHTML = menuItems; + const $wrapper = $(div); const $items = $wrapper.find('> .item'); $items.each((_, item) => updateMenuItem($dropdown[0], item)); $dropdown[0][ariaPatchKey].deferredRefreshAriaActiveItem(); -- cgit v1.2.3