diff options
| author | Grégoire Aubert <gregoire.aubert@sonarsource.com> | 2017-04-27 16:17:21 +0200 |
|---|---|---|
| committer | Grégoire Aubert <gregaubert@users.noreply.github.com> | 2017-04-28 15:32:07 +0200 |
| commit | 5d361e9ec5437d9402d95939b630796494416021 (patch) | |
| tree | 23fb2533e30dca5aef84c14e91f069490d1cfd41 /server/sonar-web/src/main/js/apps/users | |
| parent | 56194c84a561bfb8b446bf5d87c73f41e8822dab (diff) | |
| download | sonarqube-5d361e9ec5437d9402d95939b630796494416021.tar.gz sonarqube-5d361e9ec5437d9402d95939b630796494416021.zip | |
SONAR-9003 Fix Xss vulnerability
Diffstat (limited to 'server/sonar-web/src/main/js/apps/users')
| -rw-r--r-- | server/sonar-web/src/main/js/apps/users/groups-view.js | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/server/sonar-web/src/main/js/apps/users/groups-view.js b/server/sonar-web/src/main/js/apps/users/groups-view.js index f3afe2de43f..d1ea9ba765c 100644 --- a/server/sonar-web/src/main/js/apps/users/groups-view.js +++ b/server/sonar-web/src/main/js/apps/users/groups-view.js @@ -17,6 +17,7 @@ * along with this program; if not, write to the Free Software Foundation, * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +import escapeHtml from 'escape-html'; import Modal from '../../components/common/modals'; import '../../components/SelectList'; import Template from './templates/users-groups.hbs'; @@ -31,8 +32,11 @@ export default Modal.extend({ width: '100%', readOnly: false, focusSearch: false, - format(item) { - return `${item.name}<br><span class="note">${item.description}</span>`; + dangerouslyUnescapedHtmlFormat(item) { + return ( + `${escapeHtml(item.name)}<br>` + + `<span class="note">${escapeHtml(item.description)}</span>` + ); }, queryParam: 'q', searchUrl: window.baseUrl + '/api/users/groups?ps=100&login=' + this.model.id, |