From e0aa0ac69e3b81a974c9a7e5afb8e0be088d2661 Mon Sep 17 00:00:00 2001 From: Jyri-Petteri Paloposki Date: Thu, 14 Nov 2019 02:16:59 +0200 Subject: [PATCH] #2072: Remove needless sanitisation of tags. The sanitised version is only used in DB queries, which handle escaping themselves; the actual UI XSS sanitisation is handled separately. --- app/controllers/todos_controller.rb | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/app/controllers/todos_controller.rb b/app/controllers/todos_controller.rb index a23419b8..743a5515 100644 --- a/app/controllers/todos_controller.rb +++ b/app/controllers/todos_controller.rb @@ -871,14 +871,16 @@ class TodosController < ApplicationController def get_params_for_tag_view filter_format_for_tag_view - # use sanitize to prevent XSS attacks + # Don't use sanitize here because these are only used for a DB query. @tag_expr = [] - @tag_expr << sanitize(params[:name]).split(',') - @tag_expr << sanitize(params[:and]).split(',') if params[:and] + # Tag conditions handled as OR. + @tag_expr << params[:name].split(',') + # Additional tag condition(s) handled as AND. + @tag_expr << params[:and].split(',') if params[:and] i = 1 while params['and'+i.to_s] - @tag_expr << sanitize(params['and'+i.to_s]).split(',') + @tag_expr << params['and'+i.to_s].split(',') i=i+1 end