Merge pull request #38634 from qubis741/master

Fixed Active Storage Overview guide containing XSS vulnerability
rails · Mar 4, 2020 · c12c367 · c12c367
2 parents c779d52 + a29c750
commit c12c367
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/guides/source/active_storage_overview.md b/guides/source/active_storage_overview.md
@@ -664,9 +664,10 @@ addEventListener("direct-upload:initialize", event => {
   target.insertAdjacentHTML("beforebegin", `
     <div id="direct-upload-${id}" class="direct-upload direct-upload--pending">
       <div id="direct-upload-progress-${id}" class="direct-upload__progress" style="width: 0%"></div>
-      <span class="direct-upload__filename">${file.name}</span>
+      <span class="direct-upload__filename"></span>
     </div>
   `)
+  target.previousElementSibling.querySelector(`.direct-upload__filename`).textContent = file.name
 })
 
 addEventListener("direct-upload:start", event => {