On 08/09/2011 10:02 AM, Jiri Tomasek wrote:
---
src/app/views/pools/_pretty_list.haml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/src/app/views/pools/_pretty_list.haml
b/src/app/views/pools/_pretty_list.haml
index 87d1cce..72e97a1 100644
--- a/src/app/views/pools/_pretty_list.haml
+++ b/src/app/views/pools/_pretty_list.haml
@@ -28,7 +28,7 @@
= render :partial => 'deployments', :locals => {:deployments
=> pool.deployments}
%ul.content.actions
%li
- = link_to "#{pool.name} Pool details»", pool_path(pool),
:class =>'pool_details'
+ = link_to "#{pool.name} Pool details»".html_safe,
pool_path(pool), :class =>'pool_details'
%li
= link_to 'New Deployment', launch_new_deployments_path(:pool_id
=> pool.id), :class => 'button primary', :id =>
'new_deployment_button'
This could open us up to XSS vulnerability in the future.
Right now, the set of allowed characters for pool.name is restricted
enough that the attacker shouldn't be able to exploit it. However, if we
ever expand the allowed pools names, there's a good possibility we would
miss having to fix this view.
The fix is simple enough:
"#{html_escape(pool.name)} Pool details »".html_safe
Could you please change that before committing?
Cheers,
thomas|shadow
--
No trees were killed to send this message, but a large number of
electrons were terribly inconvenienced.