Files
@ c9cfaeb1cdfe
Branch filter:
Location: kallithea/CONTRIBUTORS - annotation
c9cfaeb1cdfe
3.2 KiB
text/plain
tooltips: fix unsafe insertion of userdata into the DOM as html
This fixes js injection in the admin journal ... and probably also in other places.
Tooltips are used both with hardcoded strings (which is safe and simple) and
with user provided strings wrapped in html formatting (which requires careful
escaping before being put into the DOM as html). The templating will
automatically take care of one level of escaping, but here it requires two
levels to do it correctly ... and that was not always done correctly.
Instead, by default, just insert it into the DOM as text, not as html.
The few places where we know the tooltip contains safe html are handled
specially - the element is given the safe-html-title class. That is the case in
file annotation and in display of tip revision in repo lists.
This fixes js injection in the admin journal ... and probably also in other places.
Tooltips are used both with hardcoded strings (which is safe and simple) and
with user provided strings wrapped in html formatting (which requires careful
escaping before being put into the DOM as html). The templating will
automatically take care of one level of escaping, but here it requires two
levels to do it correctly ... and that was not always done correctly.
Instead, by default, just insert it into the DOM as text, not as html.
The few places where we know the tooltip contains safe html are handled
specially - the element is given the safe-html-title class. That is the case in
file annotation and in display of tip revision in repo lists.
24c0d584ba86 79283d4b1bed 79283d4b1bed 79283d4b1bed 79283d4b1bed 3dbe675b4342 62c4027b0321 c3172bc09503 3dbe675b4342 3dedf3991d40 dc16211e7292 dc16211e7292 dc16211e7292 dc16211e7292 a7bee2a5de67 ee2817f2cb3d ee2817f2cb3d fb51a6fc10ae fb51a6fc10ae 3dbe675b4342 c4d8ed624728 9989d727ef1b 9989d727ef1b 31265f80cf8b 31265f80cf8b e61162c20222 02e668af87ac 02e668af87ac b1b31bfe2f99 b1b31bfe2f99 231160230379 c6f16271b60c 12b183c1628b 5f08551afb31 0c1c17db467c 53e5f01081ac c71e05076359 d8364b7e3451 433d6385b216 8b7294a804a0 8b7294a804a0 231160230379 8b7294a804a0 8b7294a804a0 9a6c224e1f68 8b7294a804a0 8b7294a804a0 231160230379 231160230379 231160230379 231160230379 231160230379 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c ebe8537c5c70 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c 0c4f2c53ea4c a73f98871e2b a73f98871e2b a73f98871e2b a73f98871e2b | List of contributors to Kallithea project:
Marcin Kuźmiński <marcin@python-works.com>
Lukasz Balcerzak <lukaszbalcerzak@gmail.com>
Jason Harris <jason@jasonfharris.com>
Thayne Harbaugh <thayne@fusionio.com>
cejones <>
Thomas Waldmann <tw-public@gmx.de>
Lorenzo M. Catucci <lorenzo@sancho.ccd.uniroma2.it>
Dmitri Kuznetsov <>
Jared Bunting <jared.bunting@peachjean.com>
Steve Romanow <slestak989@gmail.com>
Augosto Hermann <augusto.herrmann@planejamento.gov.br>
Ankit Solanki <ankit.solanki@gmail.com>
Liad Shani <liadff@gmail.com>
Les Peabody <lpeabody@gmail.com>
Jonas Oberschweiber <jonas.oberschweiber@d-velop.de>
Matt Zuba <matt.zuba@goodwillaz.org>
Aras Pranckevicius <aras@unity3d.com>
Tony Bussieres <t.bussieres@gmail.com>
Erwin Kroon <e.kroon@smartmetersolutions.nl>
nansenat16 <nansenat16@null.tw>
Vincent Duvert <vincent@duvert.net>
Takumi IINO <trot.thunder@gmail.com>
Indra Talip <indra.talip@gmail.com>
James Rhodes <jrhodes@redpointsoftware.com.au>
Dominik Ruf <dominikruf@gmail.com>
xpol <xpolife@gmail.com>
Vincent Caron <vcaron@bearstech.com>
Zachary Auclair <zach101@gmail.com>
Stefan Engel <mail@engel-stefan.de>
Andrew Shadura <andrew@shadura.me>
Raoul Thill <raoul.thill@gmail.com>
Philip Jameson <philip.j@hostdime.com>
Mads Kiilerich <madski@unity3d.com>
Dan Sheridan <djs@adelard.com>
Dennis Brakhane <brakhane@googlemail.com>
Simon Lopez <simon.lopez@slopez.org>
Jonathan Sternberg <jonathansternberg@gmail.com>
Grzegorz Rożniecki <xaerxess@gmail.com>
Andrew Kesterson <andrew@aklabs.net>
David A. Sjøen <david.sjoen@westcon.no>
Jelmer Vernooij <jelmer@samba.org>
larikale
SteveCohen
RhodeCode GmbH
Sebastian Kreutzberger <sebastian@rhodecode.com>
thomas <thomas@rhodecode.com>
Bradley M. Kuhn <bkuhn@sfconservancy.org>
Sean Farley <sean.michael.farley@gmail.com>
Martin Vium <martinv@unity3d.com>
Daniel Anderson <daniel@dattrix.com>
Travis Burtrum <android@moparisthebest.com>
Calinou <calinou@opmbx.org>
Christian Oyarzun <oyarzun@gmail.com>
Denis Blanchette <dblanchette@coveo.com>
duanhongyi <duanhongyi@doopai.com>
Henrik Stuart <hg@hstuart.dk>
Ingo von Borstel <kallithea@planetmaker.de>
Jan Heylen <heyleke@gmail.com>
Jim Hague <jim.hague@acm.org>
Joseph Rivera <rivera.d.joseph@gmail.com>
Kazunari Kobayashi <kobanari@nifty.com>
Matt Fellows <kallithea@matt-fellows.me.uk>
Max Roman <max@choloclos.se>
Michael Pohl <michael@mipapo.de>
Michael V. DePalatis <mike@depalatis.net>
Michal Čihař <michal@cihar.com>
Morten Skaaning <mortens@unity3d.com>
Na'Tosha Bard <natosha@unity3d.com>
Nick High <nick@silverchip.org>
Niemand Jedermann <predatorix@web.de>
Peter Vitt <petervitt@web.de>
Sam Jaques <sam.jaques@me.com>
Thomas De Schampheleire <thomas.de.schampheleire@gmail.com>
Tuux <tuxa@galaxie.eu.org>
Zoltan Gyarmati <mr.zoltan.gyarmati@gmail.com>
Kevin Bullock <kbullock@ringworld.org>
Marc Villetard <marc.villetard@gmail.com>
Matthias Zilk <matthias.zilk@gmail.com>
Tim Freund <tim@freunds.net>
|