Prevent possible XSS when using jQuery (#18289)

In the case of misuse or misunderstanding from a developer whereby,
if `sel` can receive user-controlled data, jQuery `$(sel)` can lead to the
creation of a new element. Current usage is using hard-coded selectors
in the templates, but nobody prevents that from expanding to
user-controlled somehow.
This commit is contained in:
Gusted 2022-01-16 05:14:32 +00:00 committed by GitHub
parent 4b4884ce88
commit 661d3d28e9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 39 additions and 34 deletions

View file

@ -1,7 +1,7 @@
import {initCompColorPicker} from './ColorPicker.js';
export function initCompLabelEdit(selector) {
if (!$(selector).length) return;
if (!$.find(selector).length) return;
// Create label
const $newLabelPanel = $('.new-label.segment');
$('.new-label.button').on('click', () => {