Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix XSS in card aria labels #3789

Merged
merged 1 commit into from Aug 2, 2022
Merged

Fix XSS in card aria labels #3789

merged 1 commit into from Aug 2, 2022

Conversation

thornbill
Copy link
Member

Changes
Fixes the XSS vulnerability in the aria label of card components by escaping the item name.

Issues
Fixes #3788

@thornbill thornbill added bug Something isn't working regression We broke something stable backport Backport into the next stable release security This PR or issue mainly concerns security labels Aug 2, 2022
@thornbill thornbill added this to Active PRs in Release 10.8.0 via automation Aug 2, 2022
Release 10.8.0 automation moved this from Active PRs to Approved PRs Aug 2, 2022
@sonarcloud
Copy link

sonarcloud bot commented Aug 2, 2022

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@thornbill thornbill merged commit 747f7be into jellyfin:release-10.8.z Aug 2, 2022
Release 10.8.0 automation moved this from Approved PRs to Completed PRs Aug 2, 2022
@thornbill thornbill deleted the fix-cards-xss branch August 2, 2022 18:36
jellyfin-bot pushed a commit that referenced this pull request Aug 3, 2022
@thornbill @joshuaboniface
Backport pull request #3789 from jellyfin/release-10.8.z
3fb990f 
Fix XSS in card aria labels

Original-merge: 747f7be

Merged-by: Bill Thornton <thornbill@users.noreply.github.com>

Backported-by: Joshua Boniface <joshua@boniface.me>
@jellyfin-bot jellyfin-bot moved this from Completed PRs to Jellyfinished in Release 10.8.0 Aug 3, 2022
@jellyfin-bot jellyfin-bot removed the stable backport Backport into the next stable release label Aug 3, 2022
Kakadus pushed a commit to Kakadus/jellyfin-web that referenced this pull request Oct 2, 2022
@thornbill @Kakadus
Backport pull request jellyfin#3789 from jellyfin/release-10.8.z
cf5922e 
Fix XSS in card aria labels

Original-merge: 747f7be

Merged-by: Bill Thornton <thornbill@users.noreply.github.com>

Backported-by: Joshua Boniface <joshua@boniface.me>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@oddstr13 oddstr13 oddstr13 approved these changes

@nielsvanvelzen nielsvanvelzen nielsvanvelzen approved these changes

Assignees
No one assigned
Labels
bug Something isn't working regression We broke something security This PR or issue mainly concerns security
Projects
No open projects
Release 10.8.0
  
Jellyfinished
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@thornbill @oddstr13 @nielsvanvelzen @jellyfin-bot