Skip to content

Commit

Permalink
[SECURITY CVE-2014-0046] Ensure link-to non-block escapes title.
Browse files Browse the repository at this point in the history
  • Loading branch information
rwjblue committed Feb 7, 2014
1 parent ca2dc5d commit 45ee8df
Show file tree
Hide file tree
Showing 2 changed files with 32 additions and 1 deletion.
11 changes: 10 additions & 1 deletion packages/ember-routing/lib/helpers/link_to.js
Original file line number Diff line number Diff line change
Expand Up @@ -787,7 +787,16 @@ Ember.onLoad('Ember.Handlebars', function(Handlebars) {
if (linkType === 'ID') {
options.linkTextPath = linkTitle;
options.fn = function() {
return Ember.Handlebars.get(context, linkTitle, options);
var result = Ember.Handlebars.get(context, linkTitle, options);
if (result === null || result === undefined) {
result = "";
} else if (!(result instanceof Handlebars.SafeString)) {
result = String(result);
}
if (!options.hash.unescaped){
result = Handlebars.Utils.escapeExpression(result);
}
return result;
};
} else {
options.fn = function() {
Expand Down
22 changes: 22 additions & 0 deletions packages/ember/tests/helpers/link_to_test.js
Original file line number Diff line number Diff line change
Expand Up @@ -922,6 +922,28 @@ test("The non-block form {{link-to}} performs property lookup", function() {
assertEquality('/about');
});

test("The non-block form {{link-to}} protects against XSS", function() {
Ember.TEMPLATES.application = Ember.Handlebars.compile("{{link-to display 'index' id='link'}}");

App.ApplicationController = Ember.Controller.extend({
display: 'blahzorz'
});

bootApplication();

Ember.run(router, 'handleURL', '/');

var controller = container.lookup('controller:application');

equal(Ember.$('#link', '#qunit-fixture').text(), 'blahzorz');
Ember.run(function() {
controller.set('display', '<b>BLAMMO</b>');
});

equal(Ember.$('#link', '#qunit-fixture').text(), '<b>BLAMMO</b>');
equal(Ember.$('b', '#qunit-fixture').length, 0);
});

test("the {{link-to}} helper calls preventDefault", function(){
Router.map(function() {
this.route("about");
Expand Down

0 comments on commit 45ee8df

Please sign in to comment.