diff options
| author | Petr Vobornik <pvoborni@redhat.com> | 2014-11-10 16:24:15 +0100 |
|---|---|---|
| committer | Tomas Babej <tbabej@redhat.com> | 2014-11-20 15:31:15 +0100 |
| commit | bff97e8b2e8d80e75e989b661e873c8e72cd7429 (patch) | |
| tree | a9c8eab2525c898e44a2eb228212baf9bff4a738 /install/ui/src/freeipa/Application_controller.js | |
| parent | 43285b1fc3da7ab0c0fe411295e53a45f9a42106 (diff) | |
| download | freeipa-bff97e8b2e8d80e75e989b661e873c8e72cd7429.tar.gz freeipa-bff97e8b2e8d80e75e989b661e873c8e72cd7429.tar.xz freeipa-bff97e8b2e8d80e75e989b661e873c8e72cd7429.zip | |
webui: fix potential XSS vulnerabilities
Escape user defined text to prevent XSS attacks. Extra precaution was taken
to escape also parts which are unlikely to contain user-defined text.
fixes CVE-2014-7850
https://fedorahosted.org/freeipa/ticket/4742
Reviewed-By: Tomas Babej <tbabej@redhat.com>
Diffstat (limited to 'install/ui/src/freeipa/Application_controller.js')
| -rw-r--r-- | install/ui/src/freeipa/Application_controller.js | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/install/ui/src/freeipa/Application_controller.js b/install/ui/src/freeipa/Application_controller.js index 094bd3da7..4bf76f8f5 100644 --- a/install/ui/src/freeipa/Application_controller.js +++ b/install/ui/src/freeipa/Application_controller.js @@ -252,12 +252,12 @@ define([ var error_container = $('<div/>', { 'class': 'container facet-content facet-error' }).appendTo($('.app-container .content').empty()); - error_container.append('<h1>'+name+'</h1>'); + error_container.append($('<h1/>', { text: name })); var details = $('<div/>', { 'class': 'error-details' }).appendTo(error_container); - details.append('<p> Web UI got in unrecoverable state during "'+error.phase+'" phase.</p>'); + details.append($('<p/>', { text: 'Web UI got in unrecoverable state during "' + error.phase + '" phase' })); if (error.name) window.console.error(error.name); if (error.results) { var msg = error.results.message; |