Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bugfix: Fix html special chars #1010

Closed
wants to merge 12 commits into from
Closed

bugfix: Fix html special chars #1010

wants to merge 12 commits into from

Conversation

sirugh
Copy link
Contributor

@sirugh sirugh commented Mar 11, 2019

Recreated based on #985.

Description

Fixed HTML special characters issue for the product name on the category page and product view page.

Related Issue

Closes #984

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

screenshot

Proposed Labels for Change Type/Package

Checklist:

  • I have read the CONTRIBUTING document.
  • I have linked an issue to this PR.
  • I have indicated the change type and relevant package(s).
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes.
  • All new and existing tests passed.
  • All CI checks are green (linting, build/deploy, etc).
  • At least one core contributor has approved this PR.

@sirugh sirugh added the bug Something isn't working label Mar 11, 2019
@vercel
Copy link

vercel bot commented Mar 11, 2019

This pull request is automatically deployed with Now.
To access deployments, click Details below or on the icon next to each push.

@sirugh
Copy link
Contributor Author

sirugh commented Mar 11, 2019

@yogeshsuhagiya I remade this PR for you. Please take over it for now. You should fill out the sections that are missing content in the PR description such as "Motivation and Context" and "How has this been tested". Providing this information makes it easier for us to understand your changes. Without it we will likely push this to the bottom of the stack and prioritize other issues that have more detail.

@coveralls
Copy link

coveralls commented Mar 11, 2019

Coverage Status

Coverage increased (+0.005%) to 72.362% when pulling a4ce433 on fix_html_special_chars into 10e35b8 on develop.

@sirugh sirugh mentioned this pull request Mar 11, 2019
8 tasks
@@ -73,7 +73,7 @@ class GalleryItem extends Component {
{this.renderImage()}
</Link>
<Link to={resourceUrl(productLink)} className={classes.name}>
<span>{name}</span>
<span dangerouslySetInnerHTML={{ __html: name }} />
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not the right approach. It's a vector for XSS, and it doesn't reflect the purpose of this node (name should be a utf-8 string, not HTML).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could probably close this PR and the associated issue then, right? Seems like it isn't a real bug if the data should be a utf-8 string already.

@jimbo
Copy link
Contributor

jimbo commented Mar 14, 2019

Product names should be utf-8 strings, so you should be able to include characters such as directly in a name—without HTML entities.

Even if that weren't the case, though, we shouldn't just render database content as raw HTML, since that's what enables XSS. (If there are any other places in the app where that's happening, we should fix them.)

@jimbo jimbo closed this Mar 14, 2019
@sirugh sirugh deleted the fix_html_special_chars branch March 14, 2019 17:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants