Эх сурвалжийг харах

HUE-9391 [ui] Possible Script Execution on Documents Page in Description Field (#1193)

* HUE-9383 potential Script execution in Share Document UI (asnaik)

* Revert "HUE-9383 potential Script execution in Share Document UI (asnaik)"

This reverts commit d5f89232e91c44a6b03ebbb57666865af4ac9059.

* HUE-9391 Possible Script Execution on Documents Page in Description Field (asnaik)

Co-authored-by: Akhil Naik <asnaik@cloudere.com>
Asnaik HWX 5 жил өмнө
parent
commit
b58139ccde

+ 2 - 2
desktop/core/src/desktop/js/ko/components/contextPopover/documentContext.js

@@ -34,7 +34,7 @@ export const DOCUMENT_CONTEXT_TEMPLATE = `
       <!-- ko with: details -->
       <div class="context-popover-doc-header-link" ><a href="javascript:void(0)" data-bind="hueLink: link, click: function () { $parents[1].close(); }"><!-- ko template: { name: 'document-icon-template', data: { document: $data, showShareAddon: false } } --><!-- /ko --> <span data-bind="text:name"></span></a></div>
       <!-- ko if: description -->
-      <div class="context-popover-doc-description" data-bind="toggleOverflow: { height: 60 }"><div data-bind="html: description"></div></div>
+      <div class="context-popover-doc-description" data-bind="toggleOverflow: { height: 60 }"><div data-bind="text: description"></div></div>
       <!-- /ko -->
       <!-- /ko -->
       <!-- ko with: documentContents -->
@@ -62,7 +62,7 @@ export const DOCUMENT_CONTEXT_TEMPLATE = `
     <br/>
     <span data-bind="text: window.DOCUMENT_TYPE_I18n[type] || type"></span>
     <!-- ko if: description -->
-    <div class="context-popover-doc-description" data-bind="html: description"></div>
+    <div class="context-popover-doc-description" data-bind="text: description"></div>
     <!-- /ko -->
   </div>
 </script>

+ 1 - 1
desktop/core/src/desktop/js/ko/components/contextPopover/partitionContext.js

@@ -34,7 +34,7 @@ export const PARTITION_CONTEXT_TEMPLATE = `
         <div class="context-popover-attribute"><div>${ I18n('Created') }</div><div data-bind="text: created"></div></div>
       </div>
       <!-- ko if: description -->
-      <div class="context-popover-doc-description" data-bind="html: description"></div>
+      <div class="context-popover-doc-description" data-bind="text: description"></div>
       <!-- /ko -->
       <div class="context-popover-flex-fill">
         <table id="partitionsTable" class="table table-condensed table-nowrap">