ddmt/gitdts
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix XSS vulnerabilities (#29336)

Browse Source 
- The Wiki page did not sanitize author name
- the reviewer name on a "dismiss review" comment is also affected
- the migration page has some spots

---------

Signed-off-by: jolheiser <john.olheiser@gmail.com>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-authored-by: jolheiser <john.olheiser@gmail.com>
This commit is contained in:
6543
2024-02-22 23:37:21 +01:00
committed by GitHub
parent 6ca8cb590d
commit 4435d8a4b6
6 changed files with 93 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
templates/repo/issue/view_content/comments.tmpl
View File

@@ -615,7 +615,7 @@
{{else}}
{{$reviewerName = .Review.OriginalAuthor}}
{{end}}
{{ctx.Locale.Tr "repo.issues.review.dismissed" $reviewerName $createdStr | Safe}}
<span class="dismissed-message">{{ctx.Locale.Tr "repo.issues.review.dismissed" ($reviewerName | Escape) $createdStr | Safe}}</span>
</span>
</div>
{{if .Content}}

6
templates/repo/migrate/migrating.tmpl
View File

@@ -21,12 +21,12 @@
<div class="ui stackable middle very relaxed page grid">
<div class="sixteen wide center aligned centered column">
<div id="repo_migrating_progress">
<p>{{ctx.Locale.Tr "repo.migrate.migrating" .CloneAddr | Safe}}</p>
<p>{{ctx.Locale.Tr "repo.migrate.migrating" (.CloneAddr | Escape) | Safe}}</p>
<p id="repo_migrating_progress_message"></p>
</div>
<div id="repo_migrating_failed" class="gt-hidden">
{{if .CloneAddr}}
<p>{{ctx.Locale.Tr "repo.migrate.migrating_failed" .CloneAddr | Safe}}</p>
<p>{{ctx.Locale.Tr "repo.migrate.migrating_failed" (.CloneAddr | Escape) | Safe}}</p>
{{else}}
<p>{{ctx.Locale.Tr "repo.migrate.migrating_failed_no_addr" | Safe}}</p>
{{end}}
@@ -58,7 +58,7 @@
<div class="content">
<div class="ui warning message">
{{ctx.Locale.Tr "repo.settings.delete_notices_1" | Safe}}<br>
{{ctx.Locale.Tr "repo.settings.delete_notices_2" .Repository.FullName | Safe}}
{{ctx.Locale.Tr "repo.settings.delete_notices_2" (.Repository.FullName | Escape) | Safe}}
{{if .Repository.NumForks}}<br>
{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}
{{end}}

4
templates/repo/settings/options.tmpl
View File

@@ -906,7 +906,7 @@
<div class="content">
<div class="ui warning message">
{{ctx.Locale.Tr "repo.settings.delete_notices_1" | Safe}}<br>
{{ctx.Locale.Tr "repo.settings.delete_notices_2" .Repository.FullName | Safe}}
{{ctx.Locale.Tr "repo.settings.delete_notices_2" (.Repository.FullName | Escape) | Safe}}
{{if .Repository.NumForks}}<br>
{{ctx.Locale.Tr "repo.settings.delete_notices_fork_1"}}
{{end}}
@@ -941,7 +941,7 @@
<div class="content">
<div class="ui warning message">
{{ctx.Locale.Tr "repo.settings.delete_notices_1" | Safe}}<br>
{{ctx.Locale.Tr "repo.settings.wiki_delete_notices_1" .Repository.Name | Safe}}
{{ctx.Locale.Tr "repo.settings.wiki_delete_notices_1" (.Repository.Name | Escape) | Safe}}
</div>
<form class="ui form" action="{{.Link}}" method="post">
{{.CsrfTokenHtml}}

2
templates/repo/wiki/revision.tmpl
View File

@@ -10,7 +10,7 @@
{{$title}}
<div class="ui sub header gt-word-break">
{{$timeSince := TimeSince .Author.When ctx.Locale}}
{{ctx.Locale.Tr "repo.wiki.last_commit_info" .Author.Name $timeSince | Safe}}
{{ctx.Locale.Tr "repo.wiki.last_commit_info" (.Author.Name | Escape) $timeSince | Safe}}
</div>
</div>
</div>

2
templates/repo/wiki/view.tmpl
View File

@@ -40,7 +40,7 @@
{{$title}}
<div class="ui sub header">
{{$timeSince := TimeSince .Author.When ctx.Locale}}
{{ctx.Locale.Tr "repo.wiki.last_commit_info" .Author.Name $timeSince | Safe}}
{{ctx.Locale.Tr "repo.wiki.last_commit_info" (.Author.Name | Escape) $timeSince | Safe}}
</div>
</div>
<div class="eight wide right aligned column">