consul/nairobi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sanitize translations instead of using _html

Browse Source 
Using the `_html` suffix in an i18n key is the same as using `html_safe`
on it, which means that translation could potentially be used for XSS
attacks.
This commit is contained in:
Javi Martín
2019-10-06 00:03:50 +02:00
parent b66859945e
commit 6b1864fbcd
62 changed files with 185 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/views/verification/sms/new.html.erb
View File

@@ -27,7 +27,7 @@
<div class="small-12 medium-6">
<%= f.label :phone, t("verification.sms.new.phone"), class: "inline-block" %>
<span class="inline-block"><%= t("verification.sms.new.phone_format_html") %></span>
<span class="inline-block"><%= sanitize(t("verification.sms.new.phone_format")) %></span>
<p class="help-text" id="phone-text-help"><%= t("verification.sms.new.phone_note") %></p>
<%= f.text_field :phone, label: false,
placeholder: t("verification.sms.new.phone_placeholder"),