engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

issue-trackers: fix XSS with description field.

Browse source
This commit is contained in:
Marcin Kuzminski 2020-09-24 13:11:05 +02:00
parent 63461e605d
commit 5def722eda
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
rhodecode/lib/helpers.py
View file

@ -1615,7 +1615,7 @@ def _process_url_func(match_obj, repo_name, uid, entry,
# named regex variables
named_vars.update(match_obj.groupdict())
_url = string.Template(entry['url']).safe_substitute(**named_vars)
desc = string.Template(entry['desc']).safe_substitute(**named_vars)
desc = string.Template(escape(entry['desc'])).safe_substitute(**named_vars)
hovercard_url = string.Template(entry.get('hovercard_url', '')).safe_substitute(**named_vars)
def quote_cleaner(input_str):