Skip to content

Commit 0f2eab3

Browse files
committed
Fix XSS on tasks page
1 parent 6cc83ed commit 0f2eab3

File tree

1 file changed

+14
-1
lines changed

1 file changed

+14
-1
lines changed

flower/static/js/flower.js

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -800,7 +800,20 @@ var flower = (function () {
800800
}, {
801801
targets: 4,
802802
data: 'kwargs',
803-
visible: isColumnVisible('kwargs')
803+
visible: isColumnVisible('kwargs'),
804+
render: function (data) {
805+
var entityMap = {
806+
'&': '&',
807+
'<': '&lt;',
808+
'>': '&gt;',
809+
'"': '&quot;',
810+
'\'': '&#39;',
811+
'/': '&#x2F;'
812+
};
813+
return data.replace(/[&<>"'\/]/g, function (s) {
814+
return entityMap[s];
815+
});
816+
}
804817
}, {
805818
targets: 5,
806819
data: 'result',

0 commit comments

Comments
 (0)