From 78eb51f78079c655ef1301bd5f57c05dec49ede8 Mon Sep 17 00:00:00 2001 From: David Taylor Date: Fri, 1 Feb 2019 13:10:59 +0000 Subject: [PATCH] SECURITY: Escape HTML in dashboard report tables --- .../javascripts/admin/models/report.js.es6 | 4 ++-- test/javascripts/models/report-test.js.es6 | 16 ++++++++-------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/app/assets/javascripts/admin/models/report.js.es6 b/app/assets/javascripts/admin/models/report.js.es6 index 21caf4aec5340..d453dd04cc761 100644 --- a/app/assets/javascripts/admin/models/report.js.es6 +++ b/app/assets/javascripts/admin/models/report.js.es6 @@ -333,7 +333,7 @@ const Report = Discourse.Model.extend({ const formatedValue = () => { const topicId = row[properties.id]; const href = Discourse.getURL(`/t/-/${topicId}`); - return `${topicTitle}`; + return `${escapeExpression(topicTitle)}`; }; return { @@ -352,7 +352,7 @@ const Report = Discourse.Model.extend({ property: properties.title, value: postTitle, formatedValue: - postTitle && href ? `${postTitle}` : "—" + postTitle && href ? `${escapeExpression(postTitle)}` : "—" }; }, diff --git a/test/javascripts/models/report-test.js.es6 b/test/javascripts/models/report-test.js.es6 index 3f1dd7a40d602..3ba6a5198b02c 100644 --- a/test/javascripts/models/report-test.js.es6 +++ b/test/javascripts/models/report-test.js.es6 @@ -402,9 +402,9 @@ QUnit.test("computed labels", assert => { time_read: 287362, note: "This is a long note", topic_id: 2, - topic_title: "Test topic", + topic_title: "Test topic ", post_number: 3, - post_raw: "This is the beginning of", + post_raw: "This is the beginning of ", filesize: 582641 } ]; @@ -502,9 +502,9 @@ QUnit.test("computed labels", assert => { const computedTopicLabel = topicLabel.compute(row); assert.equal( computedTopicLabel.formatedValue, - "Test topic" + "Test topic <html>" ); - assert.equal(computedTopicLabel.value, "Test topic"); + assert.equal(computedTopicLabel.value, "Test topic "); const postLabel = computedLabels[5]; assert.equal(postLabel.mainProperty, "post_raw"); @@ -514,9 +514,9 @@ QUnit.test("computed labels", assert => { const computedPostLabel = postLabel.compute(row); assert.equal( computedPostLabel.formatedValue, - "This is the beginning of" + "This is the beginning of <html>" ); - assert.equal(computedPostLabel.value, "This is the beginning of"); + assert.equal(computedPostLabel.value, "This is the beginning of "); const filesizeLabel = computedLabels[6]; assert.equal(filesizeLabel.mainProperty, "filesize"); @@ -533,11 +533,11 @@ QUnit.test("computed labels", assert => { const postLink = computedLabels[5].compute(row).formatedValue; assert.equal( postLink, - "This is the beginning of" + "This is the beginning of <html>" ); const topicLink = computedLabels[4].compute(row).formatedValue; - assert.equal(topicLink, "Test topic"); + assert.equal(topicLink, "Test topic <html>"); const userLink = computedLabels[0].compute(row).formatedValue; assert.equal(