diff options
7 files changed, 23 insertions, 14 deletions
diff --git a/server/sonar-web/src/main/js/apps/groups/users-view.js b/server/sonar-web/src/main/js/apps/groups/users-view.js index 558be7d4160..1342c0685ab 100644 --- a/server/sonar-web/src/main/js/apps/groups/users-view.js +++ b/server/sonar-web/src/main/js/apps/groups/users-view.js @@ -17,6 +17,7 @@ * along with this program; if not, write to the Free Software Foundation, * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +import escapeHtml from 'escape-html'; import Modal from '../../components/common/modals'; import '../../components/SelectList'; import Template from './templates/groups-users.hbs'; @@ -31,8 +32,8 @@ export default Modal.extend({ width: '100%', readOnly: false, focusSearch: false, - format(item) { - return `${item.name}<br><span class="note">${item.login}</span>`; + dangerouslyUnescapedHtmlFormat(item) { + return `${escapeHtml(item.name)}<br><span class="note">${escapeHtml(item.login)}</span>`; }, queryParam: 'q', searchUrl: window.baseUrl + '/api/user_groups/users?ps=100&id=' + this.model.id, diff --git a/server/sonar-web/src/main/js/apps/permission-templates/views/GroupsView.js b/server/sonar-web/src/main/js/apps/permission-templates/views/GroupsView.js index 8c91e8784a7..ca357a43d77 100644 --- a/server/sonar-web/src/main/js/apps/permission-templates/views/GroupsView.js +++ b/server/sonar-web/src/main/js/apps/permission-templates/views/GroupsView.js @@ -17,6 +17,7 @@ * along with this program; if not, write to the Free Software Foundation, * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +import escapeHtml from 'escape-html'; import Modal from '../../../components/common/modals'; import Template from '../templates/permission-templates-groups.hbs'; import '../../../components/SelectList'; @@ -38,8 +39,8 @@ export default Modal.extend({ width: '100%', readOnly: false, focusSearch: false, - format(item) { - return item.name; + dangerouslyUnescapedHtmlFormat(item) { + return escapeHtml(item.name); }, queryParam: 'q', searchUrl: getSearchUrl(this.options.permission, this.options.permissionTemplate), diff --git a/server/sonar-web/src/main/js/apps/permission-templates/views/UsersView.js b/server/sonar-web/src/main/js/apps/permission-templates/views/UsersView.js index 6dde7ba5d71..9992398ba55 100644 --- a/server/sonar-web/src/main/js/apps/permission-templates/views/UsersView.js +++ b/server/sonar-web/src/main/js/apps/permission-templates/views/UsersView.js @@ -17,6 +17,7 @@ * along with this program; if not, write to the Free Software Foundation, * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +import escapeHtml from 'escape-html'; import Modal from '../../../components/common/modals'; import Template from '../templates/permission-templates-users.hbs'; import '../../../components/SelectList'; @@ -65,8 +66,8 @@ export default Modal.extend({ width: '100%', readOnly: false, focusSearch: false, - format(item) { - return `${item.name}<br><span class="note">${item.login}</span>`; + dangerouslyUnescapedHtmlFormat(item) { + return `${escapeHtml(item.name)}<br><span class="note">${escapeHtml(item.login)}</span>`; }, queryParam: 'q', selectUrl: window.baseUrl + '/api/permissions/add_user_to_template', diff --git a/server/sonar-web/src/main/js/apps/quality-gates/views/gate-projects-view.js b/server/sonar-web/src/main/js/apps/quality-gates/views/gate-projects-view.js index fa9d4cc1aba..7366f2533aa 100644 --- a/server/sonar-web/src/main/js/apps/quality-gates/views/gate-projects-view.js +++ b/server/sonar-web/src/main/js/apps/quality-gates/views/gate-projects-view.js @@ -18,6 +18,7 @@ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ import Marionette from 'backbone.marionette'; +import escapeHtml from 'escape-html'; import Template from '../templates/quality-gate-detail-projects.hbs'; import '../../../components/SelectList'; import { translate } from '../../../helpers/l10n'; @@ -33,8 +34,8 @@ export default Marionette.ItemView.extend({ width: '100%', readOnly: !this.options.edit, focusSearch: false, - format(item) { - return item.name; + dangerouslyUnescapedHtmlFormat(item) { + return escapeHtml(item.name); }, searchUrl: window.baseUrl + '/api/qualitygates/search?gateId=' + qualityGate.id, selectUrl: window.baseUrl + '/api/qualitygates/select', diff --git a/server/sonar-web/src/main/js/apps/quality-profiles/views/ChangeProjectsView.js b/server/sonar-web/src/main/js/apps/quality-profiles/views/ChangeProjectsView.js index 9e9fc5d79f3..b9601e3eb5c 100644 --- a/server/sonar-web/src/main/js/apps/quality-profiles/views/ChangeProjectsView.js +++ b/server/sonar-web/src/main/js/apps/quality-profiles/views/ChangeProjectsView.js @@ -43,7 +43,7 @@ export default ModalFormView.extend({ width: '100%', readOnly: false, focusSearch: false, - format(item) { + dangerouslyUnescapedHtmlFormat(item) { return escapeHtml(item.name); }, selectUrl: window.baseUrl + '/api/qualityprofiles/add_project', diff --git a/server/sonar-web/src/main/js/apps/users/groups-view.js b/server/sonar-web/src/main/js/apps/users/groups-view.js index f3afe2de43f..d1ea9ba765c 100644 --- a/server/sonar-web/src/main/js/apps/users/groups-view.js +++ b/server/sonar-web/src/main/js/apps/users/groups-view.js @@ -17,6 +17,7 @@ * along with this program; if not, write to the Free Software Foundation, * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. */ +import escapeHtml from 'escape-html'; import Modal from '../../components/common/modals'; import '../../components/SelectList'; import Template from './templates/users-groups.hbs'; @@ -31,8 +32,11 @@ export default Modal.extend({ width: '100%', readOnly: false, focusSearch: false, - format(item) { - return `${item.name}<br><span class="note">${item.description}</span>`; + dangerouslyUnescapedHtmlFormat(item) { + return ( + `${escapeHtml(item.name)}<br>` + + `<span class="note">${escapeHtml(item.description)}</span>` + ); }, queryParam: 'q', searchUrl: window.baseUrl + '/api/users/groups?ps=100&login=' + this.model.id, diff --git a/server/sonar-web/src/main/js/components/SelectList/index.js b/server/sonar-web/src/main/js/components/SelectList/index.js index 07beda9b92a..cc162f93d95 100644 --- a/server/sonar-web/src/main/js/components/SelectList/index.js +++ b/server/sonar-web/src/main/js/components/SelectList/index.js @@ -20,6 +20,7 @@ import $ from 'jquery'; import Backbone from 'backbone'; import { debounce, throttle } from 'lodash'; +import escapeHtml from 'escape-html'; import { translate } from '../../helpers/l10n'; import ItemTemplate from './templates/item.hbs'; import ListTemplate from './templates/list.hbs'; @@ -89,7 +90,7 @@ const SelectListItemView = Backbone.View.extend({ }, render() { - this.$el.html(this.template(this.settings.format(this.model.toJSON()))); + this.$el.html(this.template(this.settings.dangerouslyUnescapedHtmlFormat(this.model.toJSON()))); this.$('input').prop('name', this.model.get('name')); this.$el.toggleClass('selected', this.model.get('selected')); this.$('.select-list-list-checkbox') @@ -412,8 +413,8 @@ window.SelectList.defaults = { readOnly: false, focusSearch: true, - format(item) { - return item.value; + dangerouslyUnescapedHtmlFormat(item) { + return escapeHtml(item.value); }, parse(r) { |