scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2024-09-21 15:36:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1740 from okriuchykhin/ok_SCI_3403

Browse source 
Improve HTML data escaping in JSON endpoints [SCI-3403]
This commit is contained in:
Alex Kriuchykhin 2019-05-09 13:37:17 +02:00 committed by GitHub
parent d5e2398f5c 40550f92c9
commit 1414085656
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 28 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
app/controllers/assets_controller.rb
View file

@ -31,9 +31,8 @@ class AssetsController < ApplicationController
'asset-id' => @asset.id,
'image-tag-url' => @asset.url(:medium),
'preview-url' => asset_file_preview_path(@asset),
'filename' => truncate(@asset.file_file_name,
length:
Constants::FILENAME_TRUNCATION_LENGTH),
'filename' => truncate(escape_input(@asset.file_file_name),
length: Constants::FILENAME_TRUNCATION_LENGTH),
'download-url' => download_asset_path(@asset),
'type' => asset_data_type(@asset)
}, status: 200
@ -47,7 +46,7 @@ class AssetsController < ApplicationController
'id' => @asset.id,
'type' => (@asset.is_image? ? 'image' : 'file'),
'filename' => truncate(@asset.file_file_name,
'filename' => truncate(escape_input(@asset.file_file_name),
length: Constants::FILENAME_TRUNCATION_LENGTH),
'download-url' => download_asset_path(@asset, timestamp: Time.now.to_i)
}

9
app/controllers/at_who_controller.rb
View file

@ -1,4 +1,6 @@
class AtWhoController < ApplicationController
include InputSanitizeHelper
before_action :load_vars
before_action :check_users_permissions
@ -55,7 +57,7 @@ class AtWhoController < ApplicationController
format.json do
render json: {
repositories: repositories.map do |r|
[r.id, r.name.truncate(Constants::ATWHO_REP_NAME_LIMIT)]
[r.id, escape_input(r.name.truncate(Constants::ATWHO_REP_NAME_LIMIT))]
end.to_h,
status: :ok
}
@ -122,9 +124,8 @@ class AtWhoController < ApplicationController
res.each do |obj|
tmp = {}
tmp['id'] = obj[0].base62_encode
tmp['full_name'] =
obj[1].truncate(Constants::NAME_TRUNCATION_LENGTH_DROPDOWN)
tmp['email'] = obj[2]
tmp['full_name'] = escape_input(obj[1].truncate(Constants::NAME_TRUNCATION_LENGTH_DROPDOWN))
tmp['email'] = escape_input(obj[2])
tmp['img_url'] = avatar_path(obj[0], :icon_small)
data << tmp
end

4
app/controllers/global_activities_controller.rb
View file

@ -1,6 +1,8 @@
# frozen_string_literal: true
class GlobalActivitiesController < ApplicationController
include InputSanitizeHelper
def index
# Preload filter format
# {
@ -109,7 +111,7 @@ class GlobalActivitiesController < ApplicationController
.pluck(:id, :name)
next if matched.length.zero?
results[subject] = matched.map { |pr| { id: pr[0], name: pr[1] } }
results[subject] = matched.map { |pr| { id: pr[0], name: escape_input(pr[1]) } }
end
respond_to do |format|
format.json do

3
app/controllers/my_modules_controller.rb
View file

@ -414,6 +414,7 @@ class MyModulesController < ApplicationController
repository: @repository.id,
record_names: dowmstream_records[my_module.id].join(', '))
end
records_names.map! { |n| escape_input(n) }
flash = I18n.t('repositories.assigned_records_flash',
records: records_names.join(', '))
flash = I18n.t('repositories.assigned_records_downstream_flash',
@ -471,7 +472,7 @@ class MyModulesController < ApplicationController
record_names: records.map(&:name).join(', '))
flash = I18n.t('repositories.unassigned_records_flash',
records: records.map(&:name).join(', '))
records: records.map { |r| escape_input(r.name) }.join(', '))
respond_to do |format|
format.json { render json: { flash: flash }, status: :ok }
end

12
app/controllers/projects_controller.rb
View file

@ -104,7 +104,7 @@ class ProjectsController < ApplicationController
up.save
log_activity(:create_project)
message = t('projects.create.success_flash', name: @project.name)
message = t('projects.create.success_flash', name: escape_input(@project.name))
respond_to do |format|
format.json {
render json: { message: message }, status: :ok
@ -136,7 +136,7 @@ class ProjectsController < ApplicationController
def update
return_error = false
flash_error = t('projects.update.error_flash', name: @project.name)
flash_error = t('projects.update.error_flash', name: escape_input(@project.name))
# Check archive permissions if archiving/restoring
if project_params.include? :archived
@ -147,7 +147,7 @@ class ProjectsController < ApplicationController
return_error = true
is_archive = project_params[:archived] == 'true' ? 'archive' : 'restore'
flash_error =
t("projects.#{is_archive}.error_flash", name: @project.name)
t("projects.#{is_archive}.error_flash", name: escape_input(@project.name))
end
elsif !can_manage_project?(@project)
render_403 && return
@ -177,11 +177,11 @@ class ProjectsController < ApplicationController
log_activity(:archive_project) if project_params[:archived] == 'true'
log_activity(:restore_project) if project_params[:archived] == 'false'
flash_success = t('projects.update.success_flash', name: @project.name)
flash_success = t('projects.update.success_flash', name: escape_input(@project.name))
if project_params[:archived] == 'true'
flash_success = t('projects.archive.success_flash', name: @project.name)
flash_success = t('projects.archive.success_flash', name: escape_input(@project.name))
elsif project_params[:archived] == 'false'
flash_success = t('projects.restore.success_flash', name: @project.name)
flash_success = t('projects.restore.success_flash', name: escape_input(@project.name))
end
respond_to do |format|
format.html do

2
app/controllers/protocols_controller.rb
View file

@ -601,7 +601,7 @@ class ProtocolsController < ApplicationController
format.json do
render json: {
name: p_name, new_name: protocol.name, status: :ok
name: escape_input(p_name), new_name: escape_input(protocol.name), status: :ok
},
status: :ok
end

4
app/controllers/repository_columns_controller.rb
View file

@ -96,7 +96,7 @@ class RepositoryColumnsController < ApplicationController
id: @repository_column.id,
name: escape_input(@repository_column.name),
message: t('libraries.repository_columns.update.success_flash',
name: @repository_column.name)
name: escape_input(@repository_column.name))
}, status: :ok
else
render json: {
@ -137,7 +137,7 @@ class RepositoryColumnsController < ApplicationController
if @repository_column.destroy
render json: {
message: t('libraries.repository_columns.destroy.success_flash',
name: column_name),
name: escape_input(column_name)),
id: column_id,
status: :ok
}

2
app/controllers/repository_rows_controller.rb
View file

@ -429,6 +429,7 @@ class RepositoryRowsController < ApplicationController
.where(repository_column: cell.repository_column)
.limit(Constants::SEARCH_LIMIT)
.pluck(:id, :data)
.map { |li| [li[0], escape_input(li[1])] }
end
def fetch_columns_list_items
@ -442,6 +443,7 @@ class RepositoryRowsController < ApplicationController
list_items: column.repository_list_items
.limit(Constants::SEARCH_LIMIT)
.pluck(:id, :data)
.map { |li| [li[0], escape_input(li[1])] }
}
end
collection

3
app/models/team.rb
View file

@ -2,6 +2,7 @@ class Team < ApplicationRecord
include SearchableModel
include ViewableModel
include TeamBySubjectModel
include InputSanitizeHelper
# Not really MVC-compliant, but we just use it for logger
# output in space_taken related functions
@ -321,7 +322,7 @@ class Team < ApplicationRecord
query = query.where(id: users_team)
end
query = query.where(id: team_by_subject(filters[:subjects])) if filters[:subjects]
query.select(:id, :name)
query.select(:id, :name).map { |res| [res[0], escape_input(res[1])] }
end
private

3
app/models/user.rb
View file

@ -5,6 +5,7 @@ class User < ApplicationRecord
include User::TeamRoles
include User::ProjectRoles
include TeamBySubjectModel
include InputSanitizeHelper
acts_as_token_authenticatable
devise :invitable, :confirmable, :database_authenticatable, :registerable,
@ -553,7 +554,7 @@ class User < ApplicationRecord
User.where(id: UserTeam.where(team_id: query_teams).select(:user_id))
.search(false, search_query)
.select(:full_name, :id)
.map { |i| { name: i[:full_name], id: i[:id] } }
.map { |i| { name: escape_input(i[:full_name]), id: i[:id] } }
end
protected