QT/sure
1
0
Fork 0
mirror of https://github.com/we-promise/sure.git synced 2026-05-12 15:15:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(accounts): sanitize activity entry names for highlighting

Browse Source 
* Updated the `highlight_activity_entry_name` method to escape HTML in activity entry names before highlighting. This change prevents potential XSS vulnerabilities and ensures safe rendering of user-generated content.
This commit is contained in:
bugbug11111
2026-05-05 12:07:04 +02:00
parent 5519716274
commit 86d92508cb
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/helpers/accounts_helper.rb
View File

@@ -15,6 +15,7 @@ module AccountsHelper
search = query.to_s.strip search = query.to_s.strip
return name if search.blank? return name if search.blank?
highlight(name, search, highlighter: ACTIVITY_HIGHLIGHT_MARKUP) escaped_name = ERB::Util.html_escape(name.to_s)
highlight(escaped_name, search, highlighter: ACTIVITY_HIGHLIGHT_MARKUP, sanitize: false)
end end
end end