mirror of
https://github.com/discourse/discourse.git
synced 2024-12-15 04:36:29 +08:00
SECURITY: Escape HTML in dashboard report tables
This commit is contained in:
parent
94ccedb730
commit
78eb51f780
|
@ -333,7 +333,7 @@ const Report = Discourse.Model.extend({
|
|||
const formatedValue = () => {
|
||||
const topicId = row[properties.id];
|
||||
const href = Discourse.getURL(`/t/-/${topicId}`);
|
||||
return `<a href='${href}'>${topicTitle}</a>`;
|
||||
return `<a href='${href}'>${escapeExpression(topicTitle)}</a>`;
|
||||
};
|
||||
|
||||
return {
|
||||
|
@ -352,7 +352,7 @@ const Report = Discourse.Model.extend({
|
|||
property: properties.title,
|
||||
value: postTitle,
|
||||
formatedValue:
|
||||
postTitle && href ? `<a href='${href}'>${postTitle}</a>` : "—"
|
||||
postTitle && href ? `<a href='${href}'>${escapeExpression(postTitle)}</a>` : "—"
|
||||
};
|
||||
},
|
||||
|
||||
|
|
|
@ -402,9 +402,9 @@ QUnit.test("computed labels", assert => {
|
|||
time_read: 287362,
|
||||
note: "This is a long note",
|
||||
topic_id: 2,
|
||||
topic_title: "Test topic",
|
||||
topic_title: "Test topic <html>",
|
||||
post_number: 3,
|
||||
post_raw: "This is the beginning of",
|
||||
post_raw: "This is the beginning of <html>",
|
||||
filesize: 582641
|
||||
}
|
||||
];
|
||||
|
@ -502,9 +502,9 @@ QUnit.test("computed labels", assert => {
|
|||
const computedTopicLabel = topicLabel.compute(row);
|
||||
assert.equal(
|
||||
computedTopicLabel.formatedValue,
|
||||
"<a href='/t/-/2'>Test topic</a>"
|
||||
"<a href='/t/-/2'>Test topic <html></a>"
|
||||
);
|
||||
assert.equal(computedTopicLabel.value, "Test topic");
|
||||
assert.equal(computedTopicLabel.value, "Test topic <html>");
|
||||
|
||||
const postLabel = computedLabels[5];
|
||||
assert.equal(postLabel.mainProperty, "post_raw");
|
||||
|
@ -514,9 +514,9 @@ QUnit.test("computed labels", assert => {
|
|||
const computedPostLabel = postLabel.compute(row);
|
||||
assert.equal(
|
||||
computedPostLabel.formatedValue,
|
||||
"<a href='/t/-/2/3'>This is the beginning of</a>"
|
||||
"<a href='/t/-/2/3'>This is the beginning of <html></a>"
|
||||
);
|
||||
assert.equal(computedPostLabel.value, "This is the beginning of");
|
||||
assert.equal(computedPostLabel.value, "This is the beginning of <html>");
|
||||
|
||||
const filesizeLabel = computedLabels[6];
|
||||
assert.equal(filesizeLabel.mainProperty, "filesize");
|
||||
|
@ -533,11 +533,11 @@ QUnit.test("computed labels", assert => {
|
|||
const postLink = computedLabels[5].compute(row).formatedValue;
|
||||
assert.equal(
|
||||
postLink,
|
||||
"<a href='/forum/t/-/2/3'>This is the beginning of</a>"
|
||||
"<a href='/forum/t/-/2/3'>This is the beginning of <html></a>"
|
||||
);
|
||||
|
||||
const topicLink = computedLabels[4].compute(row).formatedValue;
|
||||
assert.equal(topicLink, "<a href='/forum/t/-/2'>Test topic</a>");
|
||||
assert.equal(topicLink, "<a href='/forum/t/-/2'>Test topic <html></a>");
|
||||
|
||||
const userLink = computedLabels[0].compute(row).formatedValue;
|
||||
assert.equal(
|
||||
|
|
Loading…
Reference in New Issue
Block a user