From 897e95f252d5ae412678ea51951780f50dac06f9 Mon Sep 17 00:00:00 2001
From: Marcin Lulek <mlulek@rhodecode.com>
Date: Wed, 18 Oct 2017 11:21:18 +0200
Subject: [PATCH] select2: always escape .text attributes to prevent XSS via
 vcs references.

---
 rhodecode/public/js/src/rhodecode.js                 | 2 +-
 rhodecode/public/js/src/rhodecode/select2_widgets.js | 4 +---
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/rhodecode/public/js/src/rhodecode.js b/rhodecode/public/js/src/rhodecode.js
index cce9f4f3..dabef948 100644
--- a/rhodecode/public/js/src/rhodecode.js
+++ b/rhodecode/public/js/src/rhodecode.js
@@ -223,7 +223,7 @@ var formatSelect2SelectionRefs = function(commit_ref){
   } else if (commit_ref.type === 'book'){
     tmpl = tmpl.concat('<i class="icon-bookmark"></i> ');
   }
-  return tmpl.concat(commit_ref.text);
+  return tmpl.concat(escapeHtml(commit_ref.text));
 };
 
 // takes a given html element and scrolls it down offset pixels
diff --git a/rhodecode/public/js/src/rhodecode/select2_widgets.js b/rhodecode/public/js/src/rhodecode/select2_widgets.js
index 98c548d1..c1b9303c 100644
--- a/rhodecode/public/js/src/rhodecode/select2_widgets.js
+++ b/rhodecode/public/js/src/rhodecode/select2_widgets.js
@@ -35,7 +35,6 @@ var select2RefBaseSwitcher = function(targetElement, loadUrl, initialData){
   $(targetElement).select2({
     cachedDataSource: {},
     dropdownAutoWidth: true,
-    formatResult: formatResult,
     width: "resolve",
     containerCssClass: "drop-menu",
     dropdownCssClass: "drop-menu-dropdown",
@@ -59,11 +58,10 @@ var select2RefBaseSwitcher = function(targetElement, loadUrl, initialData){
         });
       }
     },
-
     initSelection: function(element, callback) {
       callback(initialData);
     },
-
+    formatResult: formatResult,
     formatSelection: formatSelection
   });