Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Filter $versions values before print them on footer #2368

Merged
merged 2 commits into from Sep 22, 2022
Merged

Conversation

rdwebdesign
Copy link
Member

@rdwebdesign rdwebdesign commented Sep 20, 2022

What does this PR aim to accomplish?

Fix #2367.
This assures no unwanted scripts could be passed to the browser, to avoid arbitrary code is injection.

How does this PR accomplish the above?

Allowing only a minimum set of characters for version/branch/commit values.
(Upper and lowercase letters, digits, dot, colon, dash, underscore and slash).

We decided to allow any strings on the file and encode the output before printing on HTML page.

What documentation changes (if any) are needed to support this PR?

none


By submitting this pull request, I confirm the following:

  1. I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
  2. I have commented my proposed changes within the code and I have tested my changes.
  3. I am willing to help maintain this change if there are issues with it later.
  4. It is compatible with the EUPL 1.2 license
  5. I have squashed any insignificant commits. (git rebase)

  • I have read the above and my PR is ready for review. Check this box to confirm

Copy link
Member

@yubiuser yubiuser left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we get this on a line-by-line approach and print "N/A" for lines that are affected? Also if the left-hand side of e.g. "WEB_BRANCH=mast§$$§er" is affected the current implementation will print vDev which seems not right.

@xPaw
Copy link

xPaw commented Sep 21, 2022

It's better to just use something like htmlspecialchars when printing, instead of trying to filter the string.

Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
Copy link
Member

@yubiuser yubiuser left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Before:
Screenshot at 2022-09-22 14-32-36

After:
Screenshot at 2022-09-22 14-33-28

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants