Sfoglia il codice sorgente

HUE-9383 [core] Avoid potential script execution in Share Document UI (#1203)

* HUE-9383 potential Script execution in Share Document UI (asnaik)

* HUE-9383 potential Script execution in Share Document UI (asnaik)

* HUE-9383 potential Script execution in Share Document UI (asnaik) es-lint-Fix

Co-authored-by: Akhil Naik <asnaik@cloudere.com>
Co-authored-by: Romain Rigaux <romain.rigaux@gmail.com>
Asnaik HWX 5 anni fa
parent
commit
45153325c9
1 ha cambiato i file con 5 aggiunte e 2 eliminazioni
  1. 5 2
      desktop/core/src/desktop/js/doc/hueDocument.js

+ 5 - 2
desktop/core/src/desktop/js/doc/hueDocument.js

@@ -87,7 +87,7 @@ class HueDocument {
     const successCallback = jsonUserGroups => {
       self.items = [];
       jsonUserGroups.users.forEach(user => {
-        const label = self.prettifyUsername(user);
+        const label = hueUtils.escapeOutput(self.prettifyUsername(user));
         const highLightedLabel = hueUtils.highlight(label, request.term);
         self.userMap[label] = user;
         self.items.push({
@@ -101,7 +101,10 @@ class HueDocument {
       });
       jsonUserGroups.groups.forEach(group => {
         self.groupMap[group.name] = group;
-        const highLightedLabel = hueUtils.highlight(group.name, request.term);
+        const highLightedLabel = hueUtils.highlight(
+          hueUtils.escapeOutput(group.name),
+          request.term
+        );
         self.items.push({
           data: {
             icon: 'fa fa-users',