Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Forbid HTML injection using jQuery #29843

Merged
merged 2 commits into from
Mar 16, 2024

Conversation

yardenshoham
Copy link
Member

See https://github.com/wikimedia/eslint-plugin-no-jquery/blob/master/docs/rules/no-append-html.md

Tested the following components and they work as before:

  • notification table
  • issue author dropdown
  • comment edit box attachments div

See https://github.com/wikimedia/eslint-plugin-no-jquery/blob/master/docs/rules/no-append-html.md

Tested the following components and they work as before:
- notification table
- issue author dropdown
- comment edit box attachments div

Signed-off-by: Yarden Shoham <git@yardenshoham.com>
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Mar 16, 2024
@pull-request-size pull-request-size bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Mar 16, 2024
@yardenshoham yardenshoham added the type/refactoring Existing code has been cleaned up. There should be no new functionality. label Mar 16, 2024
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Mar 16, 2024
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Mar 16, 2024
@yardenshoham yardenshoham added the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Mar 16, 2024
@silverwind silverwind enabled auto-merge (squash) March 16, 2024 13:20
@silverwind silverwind merged commit f9b4efd into go-gitea:main Mar 16, 2024
26 checks passed
@GiteaBot GiteaBot added this to the 1.23.0 milestone Mar 16, 2024
@GiteaBot GiteaBot removed the reviewed/wait-merge This pull request is part of the merge queue. It will be merged soon. label Mar 16, 2024
@yardenshoham yardenshoham deleted the forbid-jquery-append-html branch March 16, 2024 13:26
zjjhot added a commit to zjjhot/gitea that referenced this pull request Mar 16, 2024
* giteaofficial/main: (28 commits)
  Forbid jQuery `.prop` and fix related issues (go-gitea#29832)
  Fix wrong test for TestPullView_CodeOwner (go-gitea#29838)
  Forbid HTML injection using jQuery (go-gitea#29843)
  Meilisearch double quote on "match" query (go-gitea#29740)
  Forbid variables containing jQuery collections not having the `$` prefix (go-gitea#29839)
  Remove AddParamIfExist(AddParam) (go-gitea#29841)
  Refactor markdown attention render (go-gitea#29833)
  Refactor code_indexer to use an SearchOptions struct for PerformSearch (go-gitea#29724)
  Refactor AddParam to AddParamIfExist (go-gitea#29834)
  Forbid jQuery AJAX (go-gitea#29818)
  Remove jQuery AJAX from the notifications (go-gitea#29817)
  Light theme color enhancements (go-gitea#29830)
  Better highlighting of archved labels (go-gitea#29749)
  Remove the `time-since` class (go-gitea#29826)
  Remove jQuery AJAX from the project page (go-gitea#29814)
  Upgrade `htmx` to v1.9.11 (go-gitea#29821)
  Dark theme color enhancements (go-gitea#29822)
  Remove jQuery AJAX from the comment edit box (go-gitea#29812)
  Tweak labeler (go-gitea#29809)
  Fix `for` attribute not pointing to the ID of the color picker (go-gitea#29813)
  ...

# Conflicts:
#	routers/web/user/home.go
@wxiaoguang
Copy link
Contributor

-> Edit comment bug #29986

image

@lunny lunny modified the milestones: 1.23.0, 1.22.0 Mar 22, 2024
@go-gitea go-gitea locked as resolved and limited conversation to collaborators Jun 14, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. modifies/internal modifies/js size/S Denotes a PR that changes 10-29 lines, ignoring generated files. type/refactoring Existing code has been cleaned up. There should be no new functionality.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants