consul/nairobi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sanitize translations instead of using _html

Browse Source 
Using the `_html` suffix in an i18n key is the same as using `html_safe`
on it, which means that translation could potentially be used for XSS
attacks.
This commit is contained in:
Javi Martín
2019-10-06 00:03:50 +02:00
parent b66859945e
commit 6b1864fbcd
62 changed files with 185 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/views/dashboard/mailer/forward.html.erb
View File

@@ -8,7 +8,7 @@
<%= image_tag "quote_before_white.png", style: "max-width: 40px; vertical-align: top;" %>
<h1 style="color: #fff; font-size: 60px; line-height: 90px; display: inline;"><%= @proposal.title %></h1>
<%= image_tag "quote_after_white.png", style: "max-width: 40px; vertical-align: top;" %>
<h2 style="color: #fff; font-size: 40px; line-height: 60px"><%= t("dashboard.mailer.forward.subtitle_html") %></h2>
<h2 style="color: #fff; font-size: 40px; line-height: 60px"><%= sanitize(t("dashboard.mailer.forward.subtitle")) %></h2>
</td>
</tr>
</tbody>

2
app/views/dashboard/mailing/index.html.erb
View File

@@ -5,7 +5,7 @@
<%= image_tag "quote_before_white.png" %>
<h1 class="inline"><%= proposal.title %></h1>
<%= image_tag "quote_after_white.png" %>
<h2><%= t("dashboard.mailer.forward.subtitle_html") %></h2>
<h2><%= sanitize(t("dashboard.mailer.forward.subtitle")) %></h2>
</div>
<div class="margin-bottom">

4
app/views/dashboard/poster/index.html.erb
View File

@@ -10,7 +10,7 @@
<%= t("dashboard.poster.index.poster_subtitle") %>
</h1>
<p class="intro">
<%= t("dashboard.poster.index.intro_text_html", org: Setting["org_name"]) %>
<%= sanitize(t("dashboard.poster.index.intro_text", org: Setting["org_name"])) %>
</p>
<p class="text-center">
@@ -29,7 +29,7 @@
<h3><%= proposal.title %></h3>
<%= image_tag "quote_after_blue.png" %>
<p class="poster-footer">
<%= t("dashboard.poster.index.footer_html", link: proposal_url(proposal)) %>
<%= sanitize(t("dashboard.poster.index.footer", link: proposal_url(proposal))) %>
</p>
</div>
</div>

4
app/views/dashboard/poster/index.pdf.erb
View File

@@ -16,7 +16,7 @@
</strong>
</h1>
<p class="intro">
<%= t("dashboard.poster.index.intro_text_html", org: Setting["org_name"]) %>
<%= sanitize(t("dashboard.poster.index.intro_text", org: Setting["org_name"])) %>
</p>
<p class="text-center proposal-code">
<strong><%= t("dashboard.poster.index.proposal_code", code: proposal.code) %></strong>
@@ -34,7 +34,7 @@
<h3><strong><%= proposal.title %></strong></h3>
<%= wicked_pdf_image_tag "quote_after_blue.png" %>
<p class="poster-footer">
<%= t("dashboard.poster.index.footer_html", link: proposal_url(proposal)) %>
<%= sanitize(t("dashboard.poster.index.footer", link: proposal_url(proposal))) %>
</p>
</div>
</div>