shaba/awx
1
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2024-11-01 08:21:15 +03:00
Code Releases Activity

fix xss in activity stream, resolves #2731

Browse Source
This commit is contained in:
Leigh Johnson 2016-07-01 08:28:35 -04:00
parent 2ff5efda3b
commit 1c49ad4641
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
awx/ui/client/src/widgets/Stream.js
View File

@ -22,11 +22,11 @@ angular.module('StreamWidget', ['RestServices', 'Utilities', 'StreamListDefiniti
'RefreshHelper', listGenerator.name, 'StreamWidget', 'RefreshHelper', listGenerator.name, 'StreamWidget',
]) ])
.factory('BuildAnchor', [ '$log', .factory('BuildAnchor', [ '$log', '$filter',
// Returns a full <a href=''>resource_name</a> HTML string if link can be derived from supplied context // Returns a full <a href=''>resource_name</a> HTML string if link can be derived from supplied context
// returns name of resource if activity stream object doesn't contain enough data to build a UI url // returns name of resource if activity stream object doesn't contain enough data to build a UI url
// arguments are: a summary_field object, a resource type, an activity stream object // arguments are: a summary_field object, a resource type, an activity stream object
function ($log) { function ($log, $filter) {
return function (obj, resource, activity) { return function (obj, resource, activity) {
var url = '/#/'; var url = '/#/';
// try/except pattern asserts that: // try/except pattern asserts that:
@ -75,11 +75,11 @@ angular.module('StreamWidget', ['RestServices', 'Utilities', 'StreamListDefiniti
default: default:
url += resource + 's/' + obj.id + '/'; url += resource + 's/' + obj.id + '/';
} }
return ' <a href=\"' + url + '\"> ' + (obj.name || obj.username) + ' </a> '; return ' <a href=\"' + url + '\"> ' + $filter('sanitize')(obj.name || obj.username) + ' </a> ';
} }
catch(err){ catch(err){
$log.debug(err); $log.debug(err);
return ' ' + (obj.name || obj.username || '') + ' '; return ' ' + $filter('sanitize')(obj.name || obj.username || '') + ' ';
} }
}; };
} }