From 7324cb32709d09c1ee00bbfceee1e12b36492236 Mon Sep 17 00:00:00 2001
From: Marcin Kuzminski <marcin@rhodecode.com>
Date: Mon, 25 May 2020 07:40:45 +0000
Subject: [PATCH] issue-tracker: fixed XSS in the newly generated description
 fields.

---
 rhodecode/lib/helpers.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rhodecode/lib/helpers.py b/rhodecode/lib/helpers.py
index 1c1551b3..ae85e8fc 100644
--- a/rhodecode/lib/helpers.py
+++ b/rhodecode/lib/helpers.py
@@ -1492,7 +1492,7 @@ def _process_url_func(match_obj, repo_name, uid, entry,
         'id-repr': issue_id,
         'issue-prefix': entry['pref'],
         'serv': entry['url'],
-        'title': desc,
+        'title': bleach.clean(desc, strip=True),
         'hovercard_url': hovercard_url
     }