Fixed an XSS vulnerability

craftcms · Jun 17, 2019 · 6432eca · 6432eca
1 parent 4a8b4fa
commit 6432eca
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 3 deletions.
diff --git a/CHANGELOG-v3.md b/CHANGELOG-v3.md
@@ -17,6 +17,9 @@
 - Fixed a bug where `Craft::alias()` wasn’t working on Windows servers. ([#4405](https://github.com/craftcms/cms/issues/4405))
 - Fixed a bug where Craft wasn't parsing the `dsn` DB connection setting properly if it was supplied.
 
+### Security
+- Fixed an XSS vulnerability.
+
 ## 3.1.30 - 2019-06-11
 
 ### Changed

diff --git a/src/web/assets/feed/dist/FeedWidget.js b/src/web/assets/feed/dist/FeedWidget.js
@@ -27,7 +27,11 @@
                             var item = response.items[i],
                                 $td = $($tds[i]);
 
-                            var widgetHtml = '<a href="' + item.permalink + '" target="_blank">' + item.title + '</a> ';
+                            var widgetHtml = $('<a/>', {
+                                href: item.permalink,
+                                target: '_blank',
+                                text: item.title
+                            }).html() + ' ';
 
                             if (item.date) {
                                 widgetHtml += '<span class="light nowrap">' + item.date + '</span>';

diff --git a/src/web/assets/feed/dist/FeedWidget.min.js b/src/web/assets/feed/dist/FeedWidget.min.js
diff --git a/src/web/assets/feed/dist/FeedWidget.min.js.map b/src/web/assets/feed/dist/FeedWidget.min.js.map