From f27398c00b015ce52ed2b547cbe8980a28d4afaf Mon Sep 17 00:00:00 2001
From: Martin Artnik <martin@scinote.net>
Date: Wed, 30 Apr 2025 12:18:05 +0200
Subject: [PATCH] Add blank state for repository template columns, fix XSS
 [SCI-11893]

---
 app/javascript/vue/repositories/modals/new.vue        | 8 ++++++--
 app/javascript/vue/shared/escape_html.js              | 6 ++++++
 app/javascript/vue/shared/repository_row_selector.vue | 3 ++-
 config/locales/en.yml                                 | 1 +
 4 files changed, 15 insertions(+), 3 deletions(-)
 create mode 100644 app/javascript/vue/shared/escape_html.js

diff --git a/app/javascript/vue/repositories/modals/new.vue b/app/javascript/vue/repositories/modals/new.vue
index 50ecaa65c..81179c327 100644
--- a/app/javascript/vue/repositories/modals/new.vue
+++ b/app/javascript/vue/repositories/modals/new.vue
@@ -39,13 +39,16 @@
                   <div class="flex gap-4 overflow-hidden items-centers">
                     <div class="truncate font-bold">{{  hoveredRow.name }}</div>
                   </div>
-                  <template v-if="hoveredRow.columns">
+                  <template v-if="hoveredRow.columns?.length !== 0">
                     <div class="flex items-center gap-0.5 overflow-hidden text-xs" v-for="column in hoveredRow.columns">
                       <span class="truncate shrink-c">{{ column[0] }}</span>
                       <span>-</span>
                       <span class="truncate shrink-0">{{ column[1] }}</span>
                     </div>
                   </template>
+                  <template v-else>
+                    {{ i18n.t('repositories.index.modal_create.only_system_defined_columns') }}
+                  </template>
                 </template>
               </div>
             </div>
@@ -65,6 +68,7 @@
 <script>
 /* global HelperModule GLOBAL_CONSTANTS */
 
+import escapeHtml from '../../shared/escape_html.js';
 import axios from '../../../packs/custom_axios.js';
 import modalMixin from '../../shared/modal_mixin';
 import SelectDropdown from '../../shared/select_dropdown.vue';
@@ -138,7 +142,7 @@ export default {
       return `
         <div class="flex items-center gap-4 w-full">
           <div class="grow overflow-hidden">
-            <div class="truncate" >${row[1]}</div>
+            <div class="truncate" >${escapeHtml(row[1])}</div>
           </div>
           <i class="sn-icon sn-icon-info show-items-columns" title="" data-item-id="${row[0]}"></i>
         </div>`;
diff --git a/app/javascript/vue/shared/escape_html.js b/app/javascript/vue/shared/escape_html.js
new file mode 100644
index 000000000..9d519bc65
--- /dev/null
+++ b/app/javascript/vue/shared/escape_html.js
@@ -0,0 +1,6 @@
+export default (unsafe) => unsafe
+  .replaceAll('&', '&amp;')
+  .replaceAll('<', '&lt;')
+  .replaceAll('>', '&gt;')
+  .replaceAll('"', '&quot;')
+  .replaceAll("'", '&#039;');
diff --git a/app/javascript/vue/shared/repository_row_selector.vue b/app/javascript/vue/shared/repository_row_selector.vue
index 08db8e9bb..4a57fb44a 100644
--- a/app/javascript/vue/shared/repository_row_selector.vue
+++ b/app/javascript/vue/shared/repository_row_selector.vue
@@ -49,6 +49,7 @@
 </template>
 
 <script>
+import escapeHtml from '../shared/escape_html.js';
 import SelectDropdown from './select_dropdown.vue';
 import axios from '../../packs/custom_axios.js';
 import {
@@ -144,7 +145,7 @@ export default {
       return `
         <div class="flex items-center gap-4 w-full">
           <div class="grow overflow-hidden">
-            <div class="truncate" >${row[1]}</div>
+            <div class="truncate" >${escapeHtml(row[1])}</div>
             <div class="text-sn-grey">IT${row[0]}</div>
           </div>
           <i class="sn-icon sn-icon-info show-items-columns" title="" data-item-id="${row[0]}" data-repository-id='${this.selectedRepository}'></i>
diff --git a/config/locales/en.yml b/config/locales/en.yml
index ca56b9c40..3c4d95b10 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -2250,6 +2250,7 @@ en:
         submit: "Create"
         success_flash_html: "Inventory <strong>%{name}</strong> successfully created."
         repository_template_label: "Select inventory template"
+        only_system_defined_columns: 'Only system defined columns.'
       modal_confirm_sharing:
         title: "Inventory sharing changes"
         description_1: "You will no longer share this inventory with some of the teams. All unshared inventory items assigned to tasks will be automatically removed and this action is irreversible. Any item relationship links (if they exist) will also be deleted."