engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): fixed xss in file diffs

Browse source
This commit is contained in:
RhodeCode Admin 2025-01-14 13:19:10 +01:00
parent 166db21812
commit 6f160d6556
2 changed files with 11 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

12
rhodecode/templates/codeblocks/diffs.mako
View file

@ -220,17 +220,23 @@ return '%s_%s_%i' % (h.md5_safe(commit+filename), type, line)
<% over_lines_changed_limit = False %>
%for i, filediff in enumerate(diffset.files):
<%
filediff.source_file_path = h.escape(filediff.source_file_path)
filediff.target_file_path = h.escape(filediff.target_file_path)
%>
%if filediff.source_file_path and filediff.target_file_path:
%if filediff.source_file_path != filediff.target_file_path:
## file was renamed, or copied
%if RENAMED_FILENODE in filediff.patch['stats']['ops']:
## file was renamed
<%
final_file_name = h.literal('{} <i class="icon-angle-left"></i> <del>{}</del>'.format(filediff.target_file_path, filediff.source_file_path))
final_file_name = h.literal(f'{filediff.target_file_path} <i class="icon-angle-left"></i> <del>{filediff.source_file_path}</del>')
final_path = filediff.target_file_path
%>
%elif COPIED_FILENODE in filediff.patch['stats']['ops']:
## file was copied
<%
final_file_name = h.literal('{} <i class="icon-angle-left"></i> {}'.format(filediff.target_file_path, filediff.source_file_path))
final_file_name = h.literal(f'{filediff.target_file_path} <i class="icon-angle-left"></i> {filediff.source_file_path}')
final_path = filediff.target_file_path
%>
%endif

4
rhodecode/tests/vcs_operations/test_vcs_operations_bad_client.py
View file

@ -59,7 +59,7 @@ class TestVCSOperationsOnUsingBadClient(object):
stdout, stderr = Command(tmpdir.strpath).execute("hg clone", clone_url, tmpdir.strpath)
# set allowed clients
setting = SettingsModel().create_or_update_setting(name=f"hg_allowed_clients", val="0.0.0")
setting = SettingsModel().create_or_update_setting(name="hg_allowed_clients", val="0.0.0")
Session().add(setting)
Session().commit()
@ -77,7 +77,7 @@ class TestVCSOperationsOnUsingBadClient(object):
stdout, stderr = Command(tmpdir.strpath).execute("git clone", clone_url, tmpdir.strpath)
# set allowed clients
setting = SettingsModel().create_or_update_setting(name=f"git_allowed_clients", val="0.0.0")
setting = SettingsModel().create_or_update_setting(name="git_allowed_clients", val="0.0.0")
Session().add(setting)
Session().commit()