SECURITY: escape title HTML for inline onebox

2025-05-22 22:43:33 +08:00 · 2019-01-10 12:02:05 +11:00
parent c85b9c6ed3
commit 35b59cfa78
2 changed files with 4 additions and 3 deletions
--- a/lib/cooked_post_processor.rb
+++ b/lib/cooked_post_processor.rb
@ -655,7 +655,7 @@ class CookedPostProcessor
    )

    if title = inline_onebox&.dig(:title)
-      element.children = title
+      element.children = CGI.escapeHTML(title)
      element.add_class(INLINE_ONEBOX_CSS_CLASS)
    end