avoid xss when using js_reverse_inline

[graingert]

No description provided.

[carnil]

@graingert do you have any information with which changes this issue has been introduced in django-js-reverse?

This issue was assigned CVE-2019-15486 so it would be useful to determine for users of older versions (for instance Debian has 0.7.3 based version in the repositories) are affected.

[graingert]

@carnil https://github.com/ierror/django-js-reverse/blob/master/CHANGELOG.rst#091

It was introduced in 0.9.0 and fixed in 0.9.1. My recommendation is to install django-csp and disable inline JavaScript

[carnil]

@

On Sat, Mar 07, 2020 at 02:32:02PM -0800, Thomas Grainger wrote: @carnil https://github.com/ierror/django-js-reverse/blob/master/CHANGELOG.rst#091 It was introduced in 0.9.0 and fixed in 0.9.1. My recommendation is to install django-csp and disable inline JavaScript

Apologies for not spotting the mentioning the CHANGELOG.rst entry and thus wasting your time. Thanks for confirming the affected range!

[graingert]

@carnil no worries it was no time at all. I appreciate being made aware of the CVE