Merge pull request #244 from modoboa/fix/xss_issue_to_field

tonioo · web-flow · commit 3b3b3b703d50 · 2023-02-16T15:56:22.000+01:00
Fixed XSS issue in To field
diff --git a/modoboa_webmail/static/modoboa_webmail/js/webmail.js b/modoboa_webmail/static/modoboa_webmail/js/webmail.js
@@ -1138,7 +1138,7 @@ Webmail.prototype = {
         var renderFunc = function (item, escape) {
             if (item.display_name) {
                 return '<div>{0} {1}</div>'.format(
-                    item.display_name,
+                    htmlEncode(item.display_name),
                     escape('<{0}>'.format(item.address)));
             }
             return '<div>{0}</div>'.format(htmlEncode(item.address));

Original file line number	Diff line number	Diff line change
`@@ -1138,7 +1138,7 @@ Webmail.prototype = {`
`1138`	`1138`	`var renderFunc = function (item, escape) {`
`1139`	`1139`	`if (item.display_name) {`
`1140`	`1140`	`return '<div>{0} {1}</div>'.format(`
`1141`		`- item.display_name,`
	`1141`	`+ htmlEncode(item.display_name),`
`1142`	`1142`	`escape('<{0}>'.format(item.address)));`
`1143`	`1143`	`}`
`1144`	`1144`	`return '<div>{0}</div>'.format(htmlEncode(item.address));`