Fix XSS vulnerability #922
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
vcastellm
approved these changes
Mar 14, 2021
|
I checked that the output gets encoded properly. Judge for yourself: |
|
@Victorcoder could you please also tag a release with that fix? |
MGSousa
pushed a commit
to MGSousa/dkron
that referenced
this pull request
Mar 15, 2021
commit a127a76 Merge: ffaf975 347cf72 Author: Miguel Sousa <miguelsousa@MacBook-Pro-de-Miguel.local> Date: Mon Mar 15 15:39:45 2021 +0000 Merge branch 'master' of https://github.com/MGSousa/dkron commit ffaf975 Author: Miguel Sousa <miguelsousa@MacBook-Pro-de-Miguel.local> Date: Mon Mar 15 13:07:06 2021 +0000 Remove custom status for untriggered/pristine jobs && Minor changes commit 8c9440b Author: Miguel Sousa <miguelsousa@MacBook-Pro-de-Miguel.local> Date: Mon Mar 15 11:44:07 2021 +0000 Added public directory commit aa96dcf Author: Miguel Sousa <miguelsousa@MacBook-Pro-de-Miguel.local> Date: Wed Mar 10 12:52:52 2021 +0000 Added Pristine Jobs to React UI commit eb18129 Author: Miguel Sousa <miguelsousa@MacBook-Pro-de-Miguel.local> Date: Mon Jan 25 11:53:02 2021 +0000 FIX change header name DKRON_PRISTINE_JOBS commit d1c3184 Author: Miguel Sousa <miguelsousa@MacBook-Pro-de-Miguel.local> Date: Mon Jan 25 10:22:15 2021 +0000 Provide filter query by job displayName, add disabled pristine jobs reports commit 347cf72 Author: Miguel Sousa <miguelsousa@MacBook-Pro-de-Miguel.local> Date: Mon Mar 15 13:07:06 2021 +0000 Remove custom status for untriggered/pristine jobs && Minor changes commit 92fd8f5 Author: Miguel Sousa <miguelsousa@MacBook-Pro-de-Miguel.local> Date: Mon Mar 15 11:44:07 2021 +0000 Added public directory commit b6b593a Author: Yuri van Oers <yvanoers@gmail.com> Date: Sun Mar 14 23:40:46 2021 +0100 Fix XSS vulnerability (distribworks#922) * Tidy modules * Fix "can't import package" error * Fix XSS vulnerability commit 2b2a2b2 Author: Etienne Duclos <duclosetienne@gmail.com> Date: Sun Mar 14 13:41:24 2021 -0400 feat(ui): add a filter on disabled state (distribworks#923) commit 31c6324 Author: Miguel Sousa <miguelsousa@MacBook-Pro-de-Miguel.local> Date: Wed Mar 10 12:52:52 2021 +0000 Added Pristine Jobs to React UI commit 92a9709 Author: Victor Castell <victor@victorcastell.com> Date: Tue Mar 9 09:37:53 2021 +0100 Update go.sum commit 296a9fa Author: Victor Castell <victor@victorcastell.com> Date: Mon Mar 8 22:44:39 2021 +0100 Update changelog commit 1a982e0 Author: Victor Castell <victor@victorcastell.com> Date: Mon Mar 8 22:30:55 2021 +0100 Add the ui/public dir (distribworks#919) It was missing because of wrong gitignore commit 20ab436 Author: Miguel Sousa <miguelsousa@MacBook-Pro-de-Miguel.local> Date: Mon Jan 25 11:53:02 2021 +0000 FIX change header name DKRON_PRISTINE_JOBS commit 5be4196 Author: Miguel Sousa <miguelsousa@MacBook-Pro-de-Miguel.local> Date: Mon Jan 25 10:22:15 2021 +0000 Provide filter query by job displayName, add disabled pristine jobs reports
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #921.
The original code seemed to deliberately use unescaped HTML. I'm hoping that was accidental and this doesn't break anything.