consul/nairobi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sanitize translations instead of using _html

Browse Source 
Using the `_html` suffix in an i18n key is the same as using `html_safe`
on it, which means that translation could potentially be used for XSS
attacks.
This commit is contained in:
Javi Martín
2019-10-06 00:03:50 +02:00
parent b66859945e
commit 6b1864fbcd
62 changed files with 185 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
app/views/mailer/budget_investment_unfeasible.html.erb
View File

@@ -9,9 +9,9 @@
</p>
<p style="font-family: 'Open Sans','Helvetica Neue',arial,sans-serif;font-size: 14px;font-weight: normal;line-height: 24px;">
<%= t("mailers.budget_investment_unfeasible.new_html",
<%= sanitize(t("mailers.budget_investment_unfeasible.new",
url: link_to(t("mailers.budget_investment_unfeasible.new_href"),
new_budget_investment_url(@investment.budget), style: "color: #2895F1; text-decoration: underline;")) %>
new_budget_investment_url(@investment.budget), style: "color: #2895F1; text-decoration: underline;"))) %>
</p>
<p style="font-family: 'Open Sans','Helvetica Neue',arial,sans-serif;font-size: 14px;font-weight: normal;line-height: 24px;">

3
app/views/mailer/comment.html.erb
View File

@@ -9,7 +9,8 @@
</p>
<p style="font-family: 'Open Sans','Helvetica Neue',arial,sans-serif;font-size: 14px;font-weight: normal;line-height: 24px;">
<%= t("mailers.comment.new_comment_by_html", commenter: @comment.author.name) %> <%= link_to @commentable.title, commentable_url(@commentable), style: "color: #2895F1; text-decoration:none;" %>
<%= sanitize(t("mailers.comment.new_comment_by", commenter: @comment.author.name)) %>
<%= link_to @commentable.title, commentable_url(@commentable), style: "color: #2895F1; text-decoration:none;" %>
</p>
<p style="border-left: 2px solid #DEE0E3;font-family: 'Open Sans','Helvetica Neue',arial,sans-serif;font-size: 14px;font-style: italic;font-weight: normal;line-height: 24px;margin-left: 20px;padding: 10px;">

4
app/views/mailer/direct_message_for_sender.html.erb
View File

@@ -1,8 +1,8 @@
<td style="padding-bottom: 20px; padding-left: 10px;">
<p style="font-family: 'Open Sans','Helvetica Neue',arial,sans-serif; font-size: 20px;">
<%= t("mailers.direct_message_for_sender.title_html",
receiver: @direct_message.receiver.name) %>
<%= sanitize(t("mailers.direct_message_for_sender.title",
receiver: @direct_message.receiver.name)) %>
</p>
<h2 style="font-family: 'Open Sans','Helvetica Neue',arial,sans-serif; font-size: 18px;">

8
app/views/mailer/email_verification.html.erb
View File

@@ -4,16 +4,16 @@
</h1>
<p style="font-family: 'Open Sans','Helvetica Neue',arial,sans-serif;font-size: 14px;font-weight: normal;line-height: 24px;">
<%= t("mailers.email_verification.instructions_html",
<%= sanitize(t("mailers.email_verification.instructions",
verification_link: link_to(
t("mailers.email_verification.click_here_to_verify"),
email_url(email_verification_token: @token))) %>
email_url(email_verification_token: @token)))) %>
</p>
<p style="font-family: 'Open Sans','Helvetica Neue',arial,sans-serif;font-size: 14px;font-weight: normal;line-height: 24px;">
<%= t("mailers.email_verification.instructions_2_html",
<%= sanitize(t("mailers.email_verification.instructions_2",
document_type: humanize_document_type(@document_type),
document_number: @document_number) %>
document_number: @document_number)) %>
</p>
<p style="font-family: 'Open Sans','Helvetica Neue',arial,sans-serif;font-size: 14px;font-weight: normal;line-height: 24px;">
<%= t("mailers.email_verification.thanks") %>

6
app/views/mailer/evaluation_comment.html.erb
View File

@@ -9,7 +9,11 @@
</p>
<p style="font-family: 'Open Sans','Helvetica Neue',arial,sans-serif;font-size: 14px;font-weight: normal;line-height: 24px;">
<%= t("mailers.evaluation_comment.new_comment_by_html", commenter: @email.comment.author.name, investment: valuation_comments_link(@email.commentable)) %>
<%= sanitize(t(
"mailers.evaluation_comment.new_comment_by",
commenter: @email.comment.author.name,
investment: valuation_comments_link(@email.commentable)
)) %>
</p>
<%= t("mailers.evaluation_comment.commenter_info", commenter: @email.comment.author.name, time: l(@email.comment.created_at)) %>

3
app/views/mailer/reply.html.erb
View File

@@ -9,7 +9,8 @@
</p>
<p style="font-family: 'Open Sans','Helvetica Neue',arial,sans-serif;font-size: 14px;font-weight: normal;line-height: 24px;">
<%= t("mailers.reply.new_reply_by_html", commenter: @email.reply.author.name) %> <%= link_to @email.commentable.title, comment_url(@email.reply.id), style: "color: #2895F1; text-decoration:none;" %>
<%= sanitize(t("mailers.reply.new_reply_by", commenter: @email.reply.author.name)) %>
<%= link_to @email.commentable.title, comment_url(@email.reply.id), style: "color: #2895F1; text-decoration:none;" %>
</p>
<div style="border-left: 2px solid #DEE0E3;font-family: 'Open Sans','Helvetica Neue',arial,sans-serif;font-size: 14px;font-style: italic;font-weight: normal;line-height: 24px;margin-left: 20px;padding: 10px;">