From 6f160d6556f5475c08f50a4b6ab22558544f7dfd Mon Sep 17 00:00:00 2001
From: RhodeCode Admin <admin@rhodecode.com>
Date: Tue, 14 Jan 2025 13:19:10 +0100
Subject: [PATCH] fix(security): fixed xss in file diffs

---
 rhodecode/templates/codeblocks/diffs.mako            | 12 +++++++++---
 .../vcs_operations/test_vcs_operations_bad_client.py |  4 ++--
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/rhodecode/templates/codeblocks/diffs.mako b/rhodecode/templates/codeblocks/diffs.mako
index 03bb67dc..84685aab 100644
--- a/rhodecode/templates/codeblocks/diffs.mako
+++ b/rhodecode/templates/codeblocks/diffs.mako
@@ -220,17 +220,23 @@ return '%s_%s_%i' % (h.md5_safe(commit+filename), type, line)
     <% over_lines_changed_limit = False %>
     %for i, filediff in enumerate(diffset.files):
 
+        <%
+            filediff.source_file_path = h.escape(filediff.source_file_path)
+            filediff.target_file_path = h.escape(filediff.target_file_path)
+        %>
+
         %if filediff.source_file_path and filediff.target_file_path:
             %if filediff.source_file_path != filediff.target_file_path:
-                 ## file was renamed, or copied
                 %if RENAMED_FILENODE in filediff.patch['stats']['ops']:
+                    ## file was renamed
                     <%
-                        final_file_name = h.literal('{} <i class="icon-angle-left"></i> <del>{}</del>'.format(filediff.target_file_path, filediff.source_file_path))
+                        final_file_name = h.literal(f'{filediff.target_file_path} <i class="icon-angle-left"></i> <del>{filediff.source_file_path}</del>')
                         final_path = filediff.target_file_path
                     %>
                 %elif COPIED_FILENODE in filediff.patch['stats']['ops']:
+                    ## file was copied
                     <%
-                        final_file_name = h.literal('{} <i class="icon-angle-left"></i> {}'.format(filediff.target_file_path, filediff.source_file_path))
+                        final_file_name = h.literal(f'{filediff.target_file_path} <i class="icon-angle-left"></i> {filediff.source_file_path}')
                         final_path = filediff.target_file_path
                     %>
                 %endif
diff --git a/rhodecode/tests/vcs_operations/test_vcs_operations_bad_client.py b/rhodecode/tests/vcs_operations/test_vcs_operations_bad_client.py
index 3c5c4ce6..db8ad4ce 100644
--- a/rhodecode/tests/vcs_operations/test_vcs_operations_bad_client.py
+++ b/rhodecode/tests/vcs_operations/test_vcs_operations_bad_client.py
@@ -59,7 +59,7 @@ class TestVCSOperationsOnUsingBadClient(object):
         stdout, stderr = Command(tmpdir.strpath).execute("hg clone", clone_url, tmpdir.strpath)
 
         # set allowed clients
-        setting = SettingsModel().create_or_update_setting(name=f"hg_allowed_clients", val="0.0.0")
+        setting = SettingsModel().create_or_update_setting(name="hg_allowed_clients", val="0.0.0")
         Session().add(setting)
         Session().commit()
 
@@ -77,7 +77,7 @@ class TestVCSOperationsOnUsingBadClient(object):
         stdout, stderr = Command(tmpdir.strpath).execute("git clone", clone_url, tmpdir.strpath)
 
         # set allowed clients
-        setting = SettingsModel().create_or_update_setting(name=f"git_allowed_clients", val="0.0.0")
+        setting = SettingsModel().create_or_update_setting(name="git_allowed_clients", val="0.0.0")
         Session().add(setting)
         Session().commit()