From 9b5a6ddb5c1ad00c83c68f65aedacf97c5dc34d7 Mon Sep 17 00:00:00 2001
From: James Mason <jmason@suse.com>
Date: Tue, 10 Oct 2017 10:22:49 -0700
Subject: [PATCH] Sanitize conference color to prevent CSS XSS injection

re: https://hakiri.io/github/openSUSE/osem/master/78eb58c93eb766505dd12319d0502c10b40a811f/warnings/7138485d39fea3
---
 app/views/conferences/show.html.haml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/views/conferences/show.html.haml b/app/views/conferences/show.html.haml
index f94b8ee4..5022a7a1 100644
--- a/app/views/conferences/show.html.haml
+++ b/app/views/conferences/show.html.haml
@@ -82,7 +82,7 @@
 
 - content_for :script_head do
   :javascript
-    var triangle_tcs = tinycolor("#{@conference.color}").monochromatic();
+    var triangle_tcs = tinycolor("#{sanitize @conference.color}").monochromatic();
     var triangle_colors = triangle_tcs.map(function(t) { return t.toHexString(); });
     $(function () {
       $(document).ready(function() {