External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-05-18 06:47:41 -02:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2351 from mabashian/2301-xss

Browse Source 
Rolls back changes to the xss filter.  Addresses escaped characters in cred tags.
This commit is contained in:
Michael Abashian
2018-06-28 15:04:56 -04:00
committed by GitHub
parent 26bd16b855 b426eeeb5c
commit 1c194dbfbc
4 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
awx/ui/client/features/output/details.component.js
View File

@@ -417,7 +417,7 @@ function buildCredentialDetails (credential) {
const icon = `${credential.kind}`; const icon = `${credential.kind}`;
const link = `/#/credentials/${credential.id}`; const link = `/#/credentials/${credential.id}`;
const tooltip = strings.get('tooltips.CREDENTIAL'); const tooltip = strings.get('tooltips.CREDENTIAL');
const value = $filter('sanitize')(credential.name); const value = credential.name;
return { icon, link, tooltip, value }; return { icon, link, tooltip, value };
} }

4
awx/ui/client/features/templates/templatesList.controller.js
View File

@@ -170,10 +170,10 @@ function ListTemplatesController(
const icon = `${credential.kind}`; const icon = `${credential.kind}`;
const link = `/#/credentials/${credential.id}`; const link = `/#/credentials/${credential.id}`;
const tooltip = strings.get('tooltips.VIEW_THE_CREDENTIAL'); const tooltip = strings.get('tooltips.VIEW_THE_CREDENTIAL');
const value = $filter('sanitize')(credential.name); const value = credential.name;
return { icon, link, tooltip, value }; return { icon, link, tooltip, value };
}) });
}; };
vm.getLastRan = template => { vm.getLastRan = template => {

2
awx/ui/client/src/shared/filters/xss-sanitizer.filter.js
View File

@@ -6,7 +6,7 @@
export default [function() { export default [function() {
return function(input) { return function(input) {
input = $("<span>").text(input)[0].textContent; input = $("<span>").text(input)[0].innerHTML;
return input; return input;
}; };
}]; }];

2
awx/ui/test/spec/shared/filters/xss-sanitizer.filter-test.js
View File

@@ -12,6 +12,6 @@ describe('Filter: sanitize', () => {
}); });
it('should sanitize xss-vulnerable strings', function(){ it('should sanitize xss-vulnerable strings', function(){
expect(filter("<div>foobar</div>")).toBe("<div>foobar</div>"); expect(filter("<div>foobar</div>")).toBe("&lt;div&gt;foobar&lt;/div&gt;");
}); });
}); });