mirror of
https://gitcode.com/gitea/gitea.git
synced 2025-05-22 01:27:48 +08:00
Prevent possible XSS when using jQuery (#18289)
In the case of misuse or misunderstanding from a developer whereby, if `sel` can receive user-controlled data, jQuery `$(sel)` can lead to the creation of a new element. Current usage is using hard-coded selectors in the templates, but nobody prevents that from expanding to user-controlled somehow.
This commit is contained in:
@ -1,7 +1,7 @@
|
||||
import {initCompColorPicker} from './ColorPicker.js';
|
||||
|
||||
export function initCompLabelEdit(selector) {
|
||||
if (!$(selector).length) return;
|
||||
if (!$.find(selector).length) return;
|
||||
// Create label
|
||||
const $newLabelPanel = $('.new-label.segment');
|
||||
$('.new-label.button').on('click', () => {
|
||||
|
Reference in New Issue
Block a user