composer/iTop
6
0
Fork 0
mirror of https://github.com/Combodo/iTop.git synced 2026-03-08 02:24:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

N°3332 Security hardening

Browse Source
This commit is contained in:
Pierre Goiffon
2020-10-19 09:24:38 +02:00
parent e6539ccb6e
commit 18d5231900
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
js/breadcrumb.js
View File

@@ -69,8 +69,8 @@ $(function()
if (sTitle.length == 0) {
sTitle = oEntry['label'];
}
sTitle = SanitizeHtml(sTitle, false);
sLabel = SanitizeHtml(sLabel, false);
sTitle = EncodeHtml(sTitle, false);
sLabel = EncodeHtml(sLabel, false);
if ((this.options.new_entry !== null) && (iEntry == aBreadCrumb.length-1)) {
// Last entry is the current page

12
js/utils.js
View File

@@ -681,16 +681,16 @@ function DisplayHistory(sSelector, sFilter, iCount, iStart) {
/**
* @param sValue value to escape
* @param bReplaceAmp if false don't replace "&" (can be useful when dealing with html entities)
* @returns {string} sanitized value, ready to insert in the DOM without XSS risk
* @param bReplaceAmp if false don't replace "&" (can be useful when sValue contrains html entities we want to keep)
* @returns {string} escaped value, ready to insert in the DOM without XSS risk
*
* @since 2.6.5, 2.7.2, 3.0.0 N°3332
* @see https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#rule-1-html-encode-before-inserting-untrusted-data-into-html-element-content
* @see https://stackoverflow.com/questions/295566/sanitize-rewrite-html-on-the-client-side/430240#430240 why inserting in the DOM (for
* example the text() JQuery way) isn't safe
*/
function SanitizeHtml(sValue, bReplaceAmp) {
var sSanitizedValue = (sValue+'')
function EncodeHtml(sValue, bReplaceAmp) {
var sEncodedValue = (sValue+'')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
@@ -698,10 +698,10 @@ function SanitizeHtml(sValue, bReplaceAmp) {
.replace(/\//g, '&#x2F;');
if (bReplaceAmp) {
sSanitizedValue = sSanitizedValue.replace(/&/g, '&amp;');
sEncodedValue = sEncodedValue.replace(/&/g, '&amp;');
}
return sSanitizedValue;
return sEncodedValue;
}
// Very simple equivalent to format: placeholders are %1$s %2$d ...