IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-02-25 18:55:32 -06:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY: XSS in bookmarks list (#13311)

Browse Source 
We should use `fancy_title` instead of `title` when displaying a topic title to ensure only the allowed html is not escaped.
This commit is contained in:
Régis Hanol 2021-06-07 16:49:57 +02:00 committed by GitHub
parent 6759e5e396
commit 3477c8a2a9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 15 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/assets/javascripts/discourse/app/helpers/topic-link.js
View File

@ -3,17 +3,20 @@ import { registerUnbound } from "discourse-common/lib/helpers";
registerUnbound("topic-link", (topic, args) => { registerUnbound("topic-link", (topic, args) => {
const title = topic.get("fancyTitle"); const title = topic.get("fancyTitle");
const url = topic.linked_post_number const url = topic.linked_post_number
? topic.urlForPostNumber(topic.linked_post_number) ? topic.urlForPostNumber(topic.linked_post_number)
: topic.get("lastUnreadUrl"); : topic.get("lastUnreadUrl");
const classes = ["title"]; const classes = ["title"];
if (args.class) { if (args.class) {
args.class.split(" ").forEach((c) => classes.push(c)); args.class.split(" ").forEach((c) => classes.push(c));
} }
const result = `<a href='${url}' return htmlSafe(
`<a href='${url}'
class='${classes.join(" ")}' class='${classes.join(" ")}'
data-topic-id='${topic.id}'>${title}</a>`; data-topic-id='${topic.id}'>${title}</a>`
return htmlSafe(result); );
}); });

10
app/assets/javascripts/discourse/app/models/bookmark.js
View File

@ -125,13 +125,9 @@ const Bookmark = RestModel.extend({
).capitalize(); ).capitalize();
}, },
@discourseComputed("linked_post_number", "title", "topic_id") @discourseComputed("linked_post_number", "fancy_title", "topic_id")
topicLink(linked_post_number, title, topic_id) { topicLink(linked_post_number, fancy_title, id) {
return Topic.create({ return Topic.create({ id, fancy_title, linked_post_number });
id: topic_id,
fancy_title: title,
linked_post_number,
});
}, },
loadItems(params) { loadItems(params) {

5
app/serializers/user_bookmark_serializer.rb
View File

@ -16,6 +16,7 @@ class UserBookmarkSerializer < ApplicationSerializer
:reminder_at, :reminder_at,
:pinned, :pinned,
:title, :title,
:fancy_title,
:deleted, :deleted,
:hidden, :hidden,
:category_id, :category_id,
@ -53,6 +54,10 @@ class UserBookmarkSerializer < ApplicationSerializer
topic.title topic.title
end end
def fancy_title
topic.fancy_title
end
def deleted def deleted
topic.deleted_at.present? || post.deleted_at.present? topic.deleted_at.present? || post.deleted_at.present?
end end