Andreas/tracks
1
0
Fork 0
mirror of https://github.com/TracksApp/tracks.git synced 2025-09-21 21:40:48 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix reflected XSS vulnerabilities in some views

Browse source
This commit is contained in:
Jyri-Petteri Paloposki 2024-07-25 15:34:44 +03:00
parent c23ca0574e
commit b0d288d2ef
2 changed files with 10 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

6
app/controllers/todos_controller.rb
View file

@ -863,8 +863,10 @@ class TodosController < ApplicationController
end
@single_tag = @tag_expr.size == 1 && @tag_expr[0].size == 1
@tag_name = @tag_expr[0][0]
@tag_title = @single_tag ? @tag_name : tag_title(@tag_expr)
# These are used in the templates, sanitise to prevent XSS.
@tag_name = sanitize(@tag_expr[0][0])
@tag_title = sanitize(@single_tag ? @tag_name : tag_title(@tag_expr))
end
def filter_format_for_tag_view

12
app/views/layouts/application.html.erb
View file

@ -7,14 +7,14 @@
<%= javascript_include_tag "application" %>
<%= csrf_meta_tags %>
<script type="text/javascript">
var SOURCE_VIEW = '<%=@source_view%>';
var AUTH_TOKEN = '<%= raw(protect_against_forgery? ? form_authenticity_token.inspect : "") %>'
var TAG_NAME = '<%= @tag_name ? @tag_name : "" %>'
var GROUP_VIEW_BY = '<%= @group_view_by ? @group_view_by : "" %>'
var SOURCE_VIEW = '<%=j @source_view %>';
var AUTH_TOKEN = '<%=j raw(protect_against_forgery? ? form_authenticity_token.inspect : "") %>'
var TAG_NAME = '<%=j @tag_name ? @tag_name : "" %>'
var GROUP_VIEW_BY = '<%=j @group_view_by ? @group_view_by : "" %>'
var defaultContexts = <%= default_contexts_for_autocomplete.html_safe rescue '{}' %>;
var defaultTags = <%= default_tags_for_autocomplete.html_safe rescue '{}' %>;
var dateFormat = '<%= date_format_for_date_picker %>';
var weekStart = '<%= current_user.prefs.week_starts %>';
var dateFormat = '<%=j date_format_for_date_picker %>';
var weekStart = '<%=j current_user.prefs.week_starts %>';
function relative_to_root(path) { return '<%= root_url %>'+path; };
<% if current_user.prefs.refresh != 0 -%>
setup_auto_refresh(<%= current_user.prefs["refresh"].to_i*60000 %>);