vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix XSS in usage log viewer

Browse source 
Fixes https://jira.coreos.com/browse/QS-82
This commit is contained in:
Joseph Schorr 2017-12-06 13:49:02 -05:00
parent 4a5626e64b
commit a2caebbb62
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
static/js/services/string-builder-service.js
View file

@ -117,8 +117,8 @@ angular.module('quay').factory('StringBuilderService', ['$sce', 'UtilService', f
value = value.substr(0, 12);
}
var safe = UtilService.escapeHtmlString(value);
var markedDown = UtilService.getMarkedDown(value);
var safe = UtilService.textToSafeHtml(value);
var markedDown = UtilService.getMarkedDown(safe);
markedDown = markedDown.substr('<p>'.length, markedDown.length - '<p></p>'.length);
var icon = fieldIcons[key];
@ -132,7 +132,7 @@ angular.module('quay').factory('StringBuilderService', ['$sce', 'UtilService', f
var codeTag = opt_codetag || 'code';
description = description.replace('{' + prefix + key + '}',
'<' + codeTag + ' title="' + safe + '">' + markedDown + '</' + codeTag + '>');
'<' + codeTag + '>' + markedDown + '</' + codeTag + '>');
return description
}