kallithea Files · .hgignore

Files @ 391fde4cbf12

Branch filter:

Location: kallithea/.hgignore

391fde4cbf12 1.1 KiB text/plain Show Annotation Show as Raw Download as Raw

Mads Kiilerich

base: escape branch/tag/bookmark names in 'Switch To' menu to prevent XSS

On repository pages, the 'Switch To' did not escape branches correctly.

This means that if an attacker is able to push a branch/tag/bookmark
containing HTML/JavaScript in its name, then that code would be evaluated.
This is a cross-site scripting (XSS) vulnerability.

Fix the problem by correctly escaping the branch/tag/bookmarks with
.html_escape() .

syntax: glob
*.pyc
*.swp
*.sqlite
*.tox
*.egg-info
*.egg
*.mo
.eggs/
tarballcache/

syntax: regexp
^rcextensions
^build
^dist/
^docs/build/
^docs/_build/
^data$
^sql_dumps/
^\.settings$
^\.project$
^\.pydevproject$
^\.coverage$
^kallithea/front-end/node_modules$
^kallithea/front-end/package-lock\.json$
^kallithea/front-end/tmp$
^kallithea/public/codemirror$
^kallithea/public/css/select2-spinner\.gif$
^kallithea/public/css/select2\.png$
^kallithea/public/css/select2x2\.png$
^kallithea/public/css/style\.css$
^kallithea/public/css/style\.css\.map$
^kallithea/public/js/bootstrap\.js$
^kallithea/public/js/dataTables\.bootstrap\.js$
^kallithea/public/js/jquery\.atwho\.min\.js$
^kallithea/public/js/jquery\.caret\.min\.js$
^kallithea/public/js/jquery\.dataTables\.js$
^kallithea/public/js/jquery\.flot\.js$
^kallithea/public/js/jquery\.flot\.selection\.js$
^kallithea/public/js/jquery\.flot\.time\.js$
^kallithea/public/js/jquery\.min\.js$
^kallithea/public/js/select2\.js$
^theme\.less$
^kallithea\.db$
^test\.db$
^Kallithea\.egg-info$
^my\.ini$
^fabfile.py
^\.idea$
^\.cache$
^\.pytest_cache$
/__pycache__$