Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Dropdown] Sanitize possible given text values #420

Merged
merged 1 commit into from
Jan 28, 2019
Merged

[Dropdown] Sanitize possible given text values #420

merged 1 commit into from
Jan 28, 2019

Conversation

lubber-de
Copy link
Member

Description

Slightly fixed a theoretical vulnerability if text-values for inline dropdowns are given. As we did it everywhere else, this is simply done by removing any double existing double quotes for a data-text value.
However, pure HTML Code injection was already sanitized when preserveHTML was used.

@lubber-de lubber-de added type/feat Any feature requests or improvements lang/javascript Anything involving JavaScript state/awaiting-reviews Pull requests which are waiting for reviews type/security Anything related to security labels Jan 23, 2019
@lubber-de lubber-de added this to the 2.7.2 milestone Jan 23, 2019
y0hami
y0hami approved these changes Jan 23, 2019
View reviewed changes
Copy link
Member

@y0hami y0hami left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

ColinFrick
ColinFrick approved these changes Jan 28, 2019
View reviewed changes
Copy link
Member

@ColinFrick ColinFrick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@y0hami y0hami merged commit 8608a4d into fomantic:develop Jan 28, 2019
@lubber-de lubber-de removed the state/awaiting-reviews Pull requests which are waiting for reviews label Jan 28, 2019
@y0hami y0hami mentioned this pull request Feb 4, 2019
Merged
@lubber-de lubber-de deleted the fix/dropdown_text_sanitzing branch February 5, 2019 11:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@y0hami y0hami y0hami approved these changes

@ColinFrick ColinFrick ColinFrick approved these changes

@prudho prudho Awaiting requested review from prudho

Assignees
No one assigned
Labels
lang/javascript Anything involving JavaScript type/feat Any feature requests or improvements type/security Anything related to security
Projects
None yet
Milestone
2.7.2
Development

Successfully merging this pull request may close these issues.
3 participants
@lubber-de @ColinFrick @y0hami