Prevent possible XSS when using jQuery (#18289)
In the case of misuse or misunderstanding from a developer whereby, if `sel` can receive user-controlled data, jQuery `$(sel)` can lead to the creation of a new element. Current usage is using hard-coded selectors in the templates, but nobody prevents that from expanding to user-controlled somehow.
This commit is contained in:
parent
4b4884ce88
commit
661d3d28e9
10 changed files with 39 additions and 34 deletions
|
@ -1,7 +1,7 @@
|
|||
import {initCompColorPicker} from './ColorPicker.js';
|
||||
|
||||
export function initCompLabelEdit(selector) {
|
||||
if (!$(selector).length) return;
|
||||
if (!$.find(selector).length) return;
|
||||
// Create label
|
||||
const $newLabelPanel = $('.new-label.segment');
|
||||
$('.new-label.button').on('click', () => {
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue