Download as
Browse Code »

Commit 57e4738a0f1c4fb784bb351c6b344c4cbeb88a97

Authored by Antonio Terceiro
1 parent c418fd0b
Exists in master and in 27 other branches 1.2+SPB2, 2_split_by_role, add_fields_in_api, api_fixies, api_pagination, api_private_token, api_tasks, article_hit_count, blog_page_bug, checkbox_to_user_can_edit_page, communities_ratings, communities_ratings_moderation, community_ratings_rebase, fix_cloned_article_parent, fix_gallery_image_url, fix_javascript_categories, fix_optional_fields, fix_suggest_article, fix_user_email_validation, highlight_block_fix, notification_plugin, notification_plugin_rebase, script_to_update, split_by_role, temp_ratings, tests, tests_fixies

Fix XSS possibility caused by quotes in article title/body

Showing 3 changed files with 18 additions and 14 deletions   Show diff stats
app/helpers/application_helper.rb
  Diff comments   View file @57e4738
... ... @@ -907,13 +907,15 @@ module ApplicationHelper
907 907 end
908 908  
909 909 def page_title
910   - (@page ? @page.title + ' - ' : '') +
911   - (@topic ? @topic.title + ' - ' : '') +
912   - (@section ? @section.title + ' - ' : '') +
913   - (@toc ? _('Online Manual') + ' - ' : '') +
914   - (controller.controller_name == 'chat' ? _('Chat') + ' - ' : '') +
915   - (profile ? profile.short_name : environment.name) +
916   - (@category ? " - #{@category.full_name}" : '')
  910 + CGI.escapeHTML(
  911 + (@page ? @page.title + ' - ' : '') +
  912 + (@topic ? @topic.title + ' - ' : '') +
  913 + (@section ? @section.title + ' - ' : '') +
  914 + (@toc ? _('Online Manual') + ' - ' : '') +
  915 + (controller.controller_name == 'chat' ? _('Chat') + ' - ' : '') +
  916 + (profile ? profile.short_name : environment.name) +
  917 + (@category ? " - #{@category.full_name}" : '')
  918 + )
917 919 end
918 920  
919 921 # DEPRECATED. Do not use this.
... ... @@ -1285,11 +1287,13 @@ module ApplicationHelper
1285 1287 end
1286 1288  
1287 1289 def delete_article_message(article)
1288   - if article.folder?
1289   - _("Are you sure that you want to remove the folder \"%s\"? Note that all the items inside it will also be removed!") % article.name
1290   - else
1291   - _("Are you sure that you want to remove the item \"%s\"?") % article.name
1292   - end
  1290 + CGI.escapeHTML(
  1291 + if article.folder?
  1292 + _("Are you sure that you want to remove the folder \"%s\"? Note that all the items inside it will also be removed!") % article.name
  1293 + else
  1294 + _("Are you sure that you want to remove the item \"%s\"?") % article.name
  1295 + end
  1296 + )
1293 1297 end
1294 1298  
1295 1299 def expirable_link_to(expired, content, url, options = {})
... ...
app/helpers/layout_helper.rb
  Diff comments   View file @57e4738
... ... @@ -91,7 +91,7 @@ module LayoutHelper
91 91 end
92 92  
93 93 def meta_description_tag(article=nil)
94   - article ? truncate(strip_tags(article.body.to_s), :length => 200) : environment.name
  94 + article ? CGI.escapeHTML(truncate(strip_tags(article.body.to_s), :length => 200)) : environment.name
95 95 end
96 96 end
97 97  
... ...
app/views/layouts/application-ng.html.erb
  Diff comments   View file @57e4738
... ... @@ -17,7 +17,7 @@
17 17 <meta property="og:url" content="<%= @page ? url_for(@page.url) : @environment.top_url %>">
18 18 <meta property="og:title" content="<%= h page_title %>">
19 19 <meta property="og:site_name" content="<%= profile ? profile.name : @environment.name %>">
20   - <meta property="og:description" content="<%= @page ? truncate(strip_tags(@page.body.to_s), :length => 200) : @environment.name %>">
  20 + <meta property="og:description" content="<%= meta_description_tag(@page) %>">
21 21  
22 22 <!-- site root -->
23 23 <meta property="noosfero:root" content="<%= Noosfero.root %>"/>
... ...