gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sanitize venue location attributes to prevent XSS JS injection

Browse source 
re: https://hakiri.io/github/openSUSE/osem/master/78eb58c93eb766505dd12319d0502c10b40a811f/warnings/77d3a6b478a6ae
https://hakiri.io/github/openSUSE/osem/master/78eb58c93eb766505dd12319d0502c10b40a811f/warnings/dae7946eda6b58
https://hakiri.io/github/openSUSE/osem/master/78eb58c93eb766505dd12319d0502c10b40a811f/warnings/466b2dce554973
This commit is contained in:
James Mason 2017-10-10 10:25:49 -07:00
parent 9b5a6ddb5c
commit c48f458a80
No known key found for this signature in database
GPG key ID: 1B3951886C449023
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
app/views/conferences/_venue_map.html.haml
View file

@ -3,14 +3,14 @@
- content_for(:script_body) do - content_for(:script_body) do
:javascript :javascript
// create a map in the "map" div, set the view to a given place and zoom // create a map in the "map" div, set the view to a given place and zoom
var map = L.map('map', { scrollWheelZoom: false }).setView([#{@conference.venue.latitude}, #{@conference.venue.longitude}], 11); var map = L.map('map', { scrollWheelZoom: false }).setView([#{sanitize @conference.venue.latitude}, #{sanitize @conference.venue.longitude}], 11);
// add an OpenStreetMap tile layer // add an OpenStreetMap tile layer
L.tileLayer('//{s}.tile.openstreetmap.org/{z}/{x}/{y}.png', { L.tileLayer('//{s}.tile.openstreetmap.org/{z}/{x}/{y}.png', {
attribution: 'Map data &copy; <a href="http://openstreetmap.org">OpenStreetMap</a> contributors, <a href="http://creativecommons.org/licenses/by-sa/2.0/">CC-BY-SA</a>, Imagery © <a href="http://mapbox.com">Mapbox</a>', attribution: 'Map data &copy; <a href="http://openstreetmap.org">OpenStreetMap</a> contributors, <a href="http://creativecommons.org/licenses/by-sa/2.0/">CC-BY-SA</a>, Imagery © <a href="http://mapbox.com">Mapbox</a>',
maxZoom: 18 maxZoom: 18
}).addTo(map); }).addTo(map);
// add a marker in the given location, attach some popup content to it and open the popup // add a marker in the given location, attach some popup content to it and open the popup
L.marker([#{@conference.venue.latitude}, #{@conference.venue.longitude}]).addTo(map) L.marker([#{sanitize @conference.venue.latitude}, #{sanitize @conference.venue.longitude}]).addTo(map)
.bindPopup("#{popup}") .bindPopup("#{popup}")
.openPopup(); .openPopup();
// Turn scrollwheel on when user clicks // Turn scrollwheel on when user clicks