nocebo/diaspora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix XSS in sharing message

Browse source
This commit is contained in:
Steffen van Bergerem 2015-12-17 01:07:57 +01:00 committed by Dennis Schubert
parent 3ac340e03e
commit e20f2ae566
3 changed files with 20 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Changelog.md
View file

@ -1,3 +1,7 @@
# 0.5.5.1
* Fix XSS on profile pages
# 0.5.5.0 # 0.5.5.0
## Bug fixes ## Bug fixes

8
app/assets/javascripts/app/helpers/handlebars-helpers.js
View file

@ -42,15 +42,15 @@ Handlebars.registerHelper('linkToPerson', function(context, block) {
}); });
// relationship indicator for profile page // relationship indicator for profile page
Handlebars.registerHelper('sharingMessage', function(person) { Handlebars.registerHelper("sharingMessage", function(person) {
var i18n_scope = 'people.helper.is_not_sharing'; var i18nScope = "people.helper.is_not_sharing";
var icon = "circle"; var icon = "circle";
if( person.is_sharing ) { if( person.is_sharing ) {
i18n_scope = 'people.helper.is_sharing'; i18nScope = "people.helper.is_sharing";
icon = "entypo check"; icon = "entypo check";
} }
var title = Diaspora.I18n.t(i18n_scope, {name: person.name}); var title = Diaspora.I18n.t(i18nScope, {name: _.escape(person.name)});
var html = '<span class="sharing_message_container" title="'+title+'" data-placement="bottom">'+ var html = '<span class="sharing_message_container" title="'+title+'" data-placement="bottom">'+
' <i id="sharing_message" class="'+icon+'"></i>'+ ' <i id="sharing_message" class="'+icon+'"></i>'+
'</span>'; '</span>';

12
spec/javascripts/app/helpers/handlebars-helpers_spec.js Normal file
View file

@ -0,0 +1,12 @@
describe("Handlebars helpers", function() {
beforeEach(function() {
Diaspora.I18n.load({people: {helper: {"is_not_sharing": "<%= name %> is not sharing with you"}}});
});
describe("sharingMessage", function() {
it("escapes the person's name", function() {
var person = { name: "\"><script>alert(0)</script> \"><script>alert(0)</script>"};
expect(Handlebars.helpers.sharingMessage(person)).not.toMatch(/<script>/);
});
});
});