Fix XSS vulnerabilities (#29336)

- The Wiki page did not sanitize author name
- the reviewer name on a "dismiss review" comment is also affected
- the migration page has some spots

---------

Signed-off-by: jolheiser <john.olheiser@gmail.com>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-authored-by: jolheiser <john.olheiser@gmail.com>
This commit is contained in:
6543
2024-02-22 23:37:21 +01:00
committed by GitHub
parent 6ca8cb590d
commit 4435d8a4b6
6 changed files with 93 additions and 8 deletions

View File

@@ -615,7 +615,7 @@
{{else}}
{{$reviewerName = .Review.OriginalAuthor}}
{{end}}
{{ctx.Locale.Tr "repo.issues.review.dismissed" $reviewerName $createdStr | Safe}}
<span class="dismissed-message">{{ctx.Locale.Tr "repo.issues.review.dismissed" ($reviewerName | Escape) $createdStr | Safe}}</span>
</span>
</div>
{{if .Content}}