scinote-eln/scinote-web
1
1
Fork 0
mirror of https://github.com/scinote-eln/scinote-web.git synced 2024-09-20 23:16:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix XSS for tasks table titles [SCI-8133] (#5134)

Browse source
This commit is contained in:
aignatov-bio 2023-03-13 15:19:59 +01:00 committed by GitHub
parent 946ea47d55
commit 40f223deca
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
app/assets/javascripts/experiments/table.js
View file

@ -1,5 +1,5 @@
/* global I18n GLOBAL_CONSTANTS InfiniteScroll
initBSTooltips filterDropdown dropdownSelector Sidebar HelperModule notTurbolinksPreview */
initBSTooltips filterDropdown dropdownSelector Sidebar HelperModule notTurbolinksPreview _ */
var ExperimnetTable = {
permissions: ['editable', 'archivable', 'restorable', 'moveable'],
@ -635,17 +635,17 @@ var ExperimnetTable = {
};
ExperimnetTable.render.task_name = function(data) {
let tooltip = ` title="${data.name}" data-toggle="tooltip" data-placement="bottom"`;
let tooltip = ` title="${_.escape(data.name)}" data-toggle="tooltip" data-placement="bottom"`;
if (data.provisioning_status === 'in_progress') {
return `<span data-full-name="${data.name}">${data.name}</span>`;
return `<span data-full-name="${_.escape(data.name)}">${data.name}</span>`;
}
return `<a
href="${data.url}"
${tooltip}
title="${data.name}"
title="${_.escape(data.name)}"
id="taskName${data.id}"
data-full-name="${data.name}">${data.name}</a>`;
data-full-name="${_.escape(data.name)}">${data.name}</a>`;
};
ExperimnetTable.render.id = function(data) {