Skip to content

Commit 3a02f08

Browse files
zeripathzeripath
authored
Escape more things that are passed through str2html (#12622) (#12850)
Backport #12622 * Escape more things that are passed through str2html Signed-off-by: Andrew Thornton <[email protected]> * Bloody editors! Co-authored-by: mrsdizzie <[email protected]> * Update routers/user/oauth.go
1 parent 408db95 commit 3a02f08

File tree

7 files changed

+18
-17
lines changed

7 files changed

+18
-17
lines changed

‎routers/user/oauth.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ package user
77
import (
88
"encoding/base64"
99
"fmt"
10+
"html"
1011
"net/url"
1112
"strings"
1213

@@ -271,8 +272,8 @@ func AuthorizeOAuth(ctx *context.Context, form auth.AuthorizationForm) {
271272
ctx.Data["Application"] = app
272273
ctx.Data["RedirectURI"] = form.RedirectURI
273274
ctx.Data["State"] = form.State
274-
ctx.Data["ApplicationUserLink"] = "<a href=\"" + setting.AppURL + app.User.LowerName + "\">@" + app.User.Name + "</a>"
275-
ctx.Data["ApplicationRedirectDomainHTML"] = "<strong>" + form.RedirectURI + "</strong>"
275+
ctx.Data["ApplicationUserLink"] = "<a href=\"" + html.EscapeString(setting.AppURL) + html.EscapeString(url.PathEscape(app.User.LowerName)) + "\">@" + html.EscapeString(app.User.Name) + "</a>"
276+
ctx.Data["ApplicationRedirectDomainHTML"] = "<strong>" + html.EscapeString(form.RedirectURI) + "</strong>"
276277
// TODO document SESSION <=> FORM
277278
err = ctx.Session.Set("client_id", app.ClientID)
278279
if err != nil {

‎templates/repo/issue/view_content/comments.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@
106106
<span class="text grey">
107107
<a class="author" href="{{.Poster.HomeLink}}">{{.Poster.GetDisplayName}}</a>
108108
{{$link := printf "%s/commit/%s" $.Repository.HTMLURL $.Issue.PullRequest.MergedCommitID}}
109-
{{$.i18n.Tr "repo.issues.pull_merged_at" $link (ShortSha $.Issue.PullRequest.MergedCommitID) $.BaseTarget $createdStr | Str2html}}
109+
{{$.i18n.Tr "repo.issues.pull_merged_at" $link (ShortSha $.Issue.PullRequest.MergedCommitID) ($.BaseTarget|Escape) $createdStr | Str2html}}
110110
</span>
111111
</div>
112112
{{else if eq .Type 3 5 6}}

‎templates/repo/issue/view_content/pull.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@
121121
{{else if .IsPullWorkInProgress}}
122122
<div class="item text grey">
123123
<i class="icon icon-octicon">{{svg "octicon-x" 16}}</i>
124-
{{$.i18n.Tr "repo.pulls.cannot_merge_work_in_progress" .WorkInProgressPrefix | Str2html}}
124+
{{$.i18n.Tr "repo.pulls.cannot_merge_work_in_progress" (.WorkInProgressPrefix|Escape) | Str2html}}
125125
</div>
126126
{{else if .Issue.PullRequest.IsChecking}}
127127
<div class="item text yellow">

‎templates/repo/issue/view_title.tmpl

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,18 +31,18 @@
3131
{{ $mergedStr:= TimeSinceUnix .Issue.PullRequest.MergedUnix $.Lang }}
3232
{{if .Issue.OriginalAuthor }}
3333
{{.Issue.OriginalAuthor}}
34-
<span class="pull-desc">{{$.i18n.Tr "repo.pulls.merged_title_desc" .NumCommits .HeadTarget .BaseTarget $mergedStr | Str2html}}</span>
34+
<span class="pull-desc">{{$.i18n.Tr "repo.pulls.merged_title_desc" .NumCommits (.HeadTarget|Escape) (.BaseTarget|Escape) $mergedStr | Str2html}}</span>
3535
{{else}}
3636
<a {{if gt .Issue.PullRequest.Merger.ID 0}}href="{{.Issue.PullRequest.Merger.HomeLink}}"{{end}}>{{.Issue.PullRequest.Merger.GetDisplayName}}</a>
37-
<span class="pull-desc">{{$.i18n.Tr "repo.pulls.merged_title_desc" .NumCommits .HeadTarget .BaseTarget $mergedStr | Str2html}}</span>
37+
<span class="pull-desc">{{$.i18n.Tr "repo.pulls.merged_title_desc" .NumCommits (.HeadTarget|Escape) (.BaseTarget|Escape) $mergedStr | Str2html}}</span>
3838
{{end}}
3939
{{else}}
4040
{{if .Issue.OriginalAuthor }}
41-
<span id="pull-desc" class="pull-desc">{{.Issue.OriginalAuthor}} {{$.i18n.Tr "repo.pulls.title_desc" .NumCommits .HeadTarget .BaseTarget | Str2html}}</span>
41+
<span id="pull-desc" class="pull-desc">{{.Issue.OriginalAuthor}} {{$.i18n.Tr "repo.pulls.title_desc" .NumCommits (.HeadTarget|Escape) (.BaseTarget|Escape) | Str2html}}</span>
4242
{{else}}
4343
<span id="pull-desc" class="pull-desc">
4444
<a {{if gt .Issue.Poster.ID 0}}href="{{.Issue.Poster.HomeLink}}"{{end}}>{{.Issue.Poster.GetDisplayName}}</a>
45-
{{$.i18n.Tr "repo.pulls.title_desc" .NumCommits .HeadTarget .BaseTarget | Str2html}}
45+
{{$.i18n.Tr "repo.pulls.title_desc" .NumCommits (.HeadTarget|Escape) (.BaseTarget|Escape) | Str2html}}
4646
</span>
4747
{{end}}
4848
<span id="pull-desc-edit" style="display: none">

‎templates/repo/settings/protected_branch.tmpl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<div class="ui container">
66
{{template "base/alert" .}}
77
<h4 class="ui top attached header">
8-
{{.i18n.Tr "repo.settings.branch_protection" .Branch.BranchName | Str2html}}
8+
{{.i18n.Tr "repo.settings.branch_protection" (.Branch.BranchName|Escape) | Str2html}}
99
</h4>
1010
<div class="ui attached segment branch-protection">
1111
<form class="ui form" action="{{.Link}}" method="post">

‎templates/user/auth/activate.tmpl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,15 @@
1515
{{else if .ResendLimited}}
1616
<p class="center">{{.i18n.Tr "auth.resent_limit_prompt"}}</p>
1717
{{else}}
18-
<p>{{.i18n.Tr "auth.confirmation_mail_sent_prompt" .SignedUser.Email .ActiveCodeLives | Str2html}}</p>
18+
<p>{{.i18n.Tr "auth.confirmation_mail_sent_prompt" (.SignedUser.Email|Escape) .ActiveCodeLives | Str2html}}</p>
1919
{{end}}
2020
{{else}}
2121
{{if .IsSendRegisterMail}}
22-
<p>{{.i18n.Tr "auth.confirmation_mail_sent_prompt" .Email .ActiveCodeLives | Str2html}}</p>
22+
<p>{{.i18n.Tr "auth.confirmation_mail_sent_prompt" (.Email|Escape) .ActiveCodeLives | Str2html}}</p>
2323
{{else if .IsActivateFailed}}
2424
<p>{{.i18n.Tr "auth.invalid_code"}}</p>
2525
{{else}}
26-
<p>{{.i18n.Tr "auth.has_unconfirmed_mail" .SignedUser.Name .SignedUser.Email | Str2html}}</p>
26+
<p>{{.i18n.Tr "auth.has_unconfirmed_mail" (.SignedUser.Name|Escape) (.SignedUser.Email|Escape) | Str2html}}</p>
2727
<div class="ui divider"></div>
2828
<div class="text right">
2929
<button class="ui blue button">{{.i18n.Tr "auth.resend_mail"}}</button>

‎templates/user/dashboard/feeds.tmpl

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,17 +50,17 @@
5050
{{$.i18n.Tr "action.reopen_pull_request" .GetRepoLink $index .ShortRepoPath | Str2html}}
5151
{{else if eq .GetOpType 16}}
5252
{{ $index := index .GetIssueInfos 0}}
53-
{{$.i18n.Tr "action.delete_tag" .GetRepoLink .GetBranch .ShortRepoPath | Str2html}}
53+
{{$.i18n.Tr "action.delete_tag" .GetRepoLink (.GetBranch|Escape) .ShortRepoPath | Str2html}}
5454
{{else if eq .GetOpType 17}}
5555
{{ $index := index .GetIssueInfos 0}}
56-
{{$.i18n.Tr "action.delete_branch" .GetRepoLink .GetBranch .ShortRepoPath | Str2html}}
56+
{{$.i18n.Tr "action.delete_branch" .GetRepoLink (.GetBranch|Escape) .ShortRepoPath | Str2html}}
5757
{{else if eq .GetOpType 18}}
5858
{{ $branchLink := .GetBranch | EscapePound}}
59-
{{$.i18n.Tr "action.mirror_sync_push" .GetRepoLink $branchLink .GetBranch .ShortRepoPath | Str2html}}
59+
{{$.i18n.Tr "action.mirror_sync_push" .GetRepoLink $branchLink (.GetBranch|Escape) .ShortRepoPath | Str2html}}
6060
{{else if eq .GetOpType 19}}
61-
{{$.i18n.Tr "action.mirror_sync_create" .GetRepoLink .GetBranch .ShortRepoPath | Str2html}}
61+
{{$.i18n.Tr "action.mirror_sync_create" .GetRepoLink (.GetBranch|Escape) .ShortRepoPath | Str2html}}
6262
{{else if eq .GetOpType 20}}
63-
{{$.i18n.Tr "action.mirror_sync_delete" .GetRepoLink .GetBranch .ShortRepoPath | Str2html}}
63+
{{$.i18n.Tr "action.mirror_sync_delete" .GetRepoLink (.GetBranch|Escape) .ShortRepoPath | Str2html}}
6464
{{else if eq .GetOpType 21}}
6565
{{ $index := index .GetIssueInfos 0}}
6666
{{$.i18n.Tr "action.approve_pull_request" .GetRepoLink $index .ShortRepoPath | Str2html}}

0 commit comments

Comments
 (0)