github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-22 05:01:14 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: prevents XSS in local-dates

Browse Source
This commit is contained in:
Joffrey JAFFEUX
2018-08-27 11:19:30 +02:00
committed by GitHub
parent cf3b7ccae2
commit 89e7d95cc7
2 changed files with 18 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
plugins/discourse-local-dates/assets/javascripts/lib/discourse-markdown/discourse-local-dates.js.es6
View File

@ -25,13 +25,17 @@ function addLocalDate(buffer, matches, state) {
token = new state.Token("span_open", "span", 1);
token.attrs = [
["class", "discourse-local-date"],
["data-date", config.date],
["data-time", config.time],
["data-format", config.format],
["data-timezones", config.timezones]
["data-date", state.md.utils.escapeHtml(config.date)],
["data-time", state.md.utils.escapeHtml(config.time)],
["data-format", state.md.utils.escapeHtml(config.format)],
["data-timezones", state.md.utils.escapeHtml(config.timezones)]
];
if (config.recurring) {
token.attrs.push(["data-recurring", config.recurring]);
token.attrs.push([
"data-recurring",
state.md.utils.escapeHtml(config.recurring)
]);
}
buffer.push(token);