issue-tracker: fixed XSS in the newly generated description fields.

2020-05-25 07:40:45 +00:00 · 2020-05-25 07:40:45 +00:00 · 7324cb3270
commit 7324cb3270
parent 57f638e62f
1 changed files with 1 additions and 1 deletions
--- a/rhodecode/lib/helpers.py
+++ b/rhodecode/lib/helpers.py
@ -1492,7 +1492,7 @@ def _process_url_func(match_obj, repo_name, uid, entry,
        'id-repr': issue_id,
        'issue-prefix': entry['pref'],
        'serv': entry['url'],
-        'title': desc,
+        'title': bleach.clean(desc, strip=True),
        'hovercard_url': hovercard_url
    }