浏览代码

HUE-5349 [search] Query definitions can include js XSS injection

Enrico Berti 9 年之前
父节点
当前提交
c4cc512

+ 1 - 1
apps/search/src/search/templates/common_search.mako

@@ -2450,7 +2450,7 @@ ${ dashboard.layout_skeleton() }
           <fieldset>
             <legend><i class="fa fa-bookmark-o"></i> ${ _('Query definitions') }
               <div class="input-append" style="margin-left: 30px; margin-top: 4px">
-                <input id="newqname" type="text" class="input-xxlarge" data-bind="value: $root.collection.newQDefinitionName, valueUpdate:'afterkeydown'" style="margin-bottom: 0" placeholder="${ _('Add current query as...') }" />
+                <input id="newqname" type="text" class="input-xxlarge" data-bind="textInput: $root.collection.newQDefinitionName, valueUpdate:'afterkeydown', tagsNotAllowed" style="margin-bottom: 0" placeholder="${ _('Add current query as...') }" />
                 <a title="${ _('Click on this button to add the currenty query as a new definition') }" class="btn plus-btn" data-bind="click: $root.collection.addQDefinition, css:{'disabled': $.trim($root.collection.newQDefinitionName()) == ''}" style="margin-top: 1px">
                   <i class="fa fa-plus"></i>
                 </a>

+ 14 - 1
desktop/core/src/desktop/static/desktop/js/ko.hue-bindings.js

@@ -4876,6 +4876,19 @@
         element.selectize.setValue(options.value());
       }
     }
-  }
+  };
+
+  ko.bindingHandlers.tagsNotAllowed = {
+    update: function (element, valueAccessor, allBindingsAccessor) {
+      var $element = $(element);
+      var params = allBindingsAccessor();
+      var valueObservable = ko.isObservable(params) ? params : (params.textInput ? params.textInput : params.value);
+      var value = valueObservable();
+      var escaped = value.replace(/<|>/g, '');
+      if (escaped !== value){
+        $element.val(escaped);
+      }
+    }
+  };
 
 })();