From c48f458a8097919196dc72df73f6f0a1dd3080b4 Mon Sep 17 00:00:00 2001
From: James Mason <jmason@suse.com>
Date: Tue, 10 Oct 2017 10:25:49 -0700
Subject: [PATCH] Sanitize venue location attributes to prevent XSS JS
 injection

re: https://hakiri.io/github/openSUSE/osem/master/78eb58c93eb766505dd12319d0502c10b40a811f/warnings/77d3a6b478a6ae
https://hakiri.io/github/openSUSE/osem/master/78eb58c93eb766505dd12319d0502c10b40a811f/warnings/dae7946eda6b58
https://hakiri.io/github/openSUSE/osem/master/78eb58c93eb766505dd12319d0502c10b40a811f/warnings/466b2dce554973
---
 app/views/conferences/_venue_map.html.haml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/views/conferences/_venue_map.html.haml b/app/views/conferences/_venue_map.html.haml
index b58b3053..b4326924 100644
--- a/app/views/conferences/_venue_map.html.haml
+++ b/app/views/conferences/_venue_map.html.haml
@@ -3,14 +3,14 @@
 - content_for(:script_body) do
   :javascript
     // create a map in the "map" div, set the view to a given place and zoom
-    var map = L.map('map', { scrollWheelZoom: false }).setView([#{@conference.venue.latitude}, #{@conference.venue.longitude}], 11);
+    var map = L.map('map', { scrollWheelZoom: false }).setView([#{sanitize @conference.venue.latitude}, #{sanitize @conference.venue.longitude}], 11);
     // add an OpenStreetMap tile layer
     L.tileLayer('//{s}.tile.openstreetmap.org/{z}/{x}/{y}.png', {
       attribution: 'Map data &copy; <a href="http://openstreetmap.org">OpenStreetMap</a> contributors, <a href="http://creativecommons.org/licenses/by-sa/2.0/">CC-BY-SA</a>, Imagery © <a href="http://mapbox.com">Mapbox</a>',
       maxZoom: 18
     }).addTo(map);
     // add a marker in the given location, attach some popup content to it and open the popup
-    L.marker([#{@conference.venue.latitude}, #{@conference.venue.longitude}]).addTo(map)
+    L.marker([#{sanitize @conference.venue.latitude}, #{sanitize @conference.venue.longitude}]).addTo(map)
       .bindPopup("#{popup}")
       .openPopup();
     // Turn scrollwheel on when user clicks