External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-01-13 02:50:02 -03:30
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2736 from leigh-johnson/2731

Browse Source 
Fix xss vulnerability in activity stream
This commit is contained in:
Leigh Johnson 2016-07-01 15:39:41 -04:00 committed by GitHub
commit 7e6f1b9bc0
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
awx/ui/client/src/widgets/Stream.js
View File

@ -22,11 +22,11 @@ angular.module('StreamWidget', ['RestServices', 'Utilities', 'StreamListDefiniti
'RefreshHelper', listGenerator.name, 'StreamWidget',
])
.factory('BuildAnchor', [ '$log',
.factory('BuildAnchor', [ '$log', '$filter',
// Returns a full <a href=''>resource_name</a> HTML string if link can be derived from supplied context
// returns name of resource if activity stream object doesn't contain enough data to build a UI url
// arguments are: a summary_field object, a resource type, an activity stream object
function ($log) {
function ($log, $filter) {
return function (obj, resource, activity) {
var url = '/#/';
// try/except pattern asserts that:
@ -75,11 +75,11 @@ angular.module('StreamWidget', ['RestServices', 'Utilities', 'StreamListDefiniti
default:
url += resource + 's/' + obj.id + '/';
}
return ' <a href=\"' + url + '\"> ' + (obj.name || obj.username) + ' </a> ';
return ' <a href=\"' + url + '\"> ' + $filter('sanitize')(obj.name || obj.username) + ' </a> ';
}
catch(err){
$log.debug(err);
return ' ' + (obj.name || obj.username || '') + ' ';
return ' ' + $filter('sanitize')(obj.name || obj.username || '') + ' ';
}
};
}