mirror of
				https://gitee.com/gitea/gitea
				synced 2025-11-04 16:40:24 +08:00 
			
		
		
		
	Prevent possible XSS when using jQuery (#18289)
In the case of misuse or misunderstanding from a developer whereby, if `sel` can receive user-controlled data, jQuery `$(sel)` can lead to the creation of a new element. Current usage is using hard-coded selectors in the templates, but nobody prevents that from expanding to user-controlled somehow.
This commit is contained in:
		@@ -1,7 +1,7 @@
 | 
			
		||||
import {initCompColorPicker} from './ColorPicker.js';
 | 
			
		||||
 | 
			
		||||
export function initCompLabelEdit(selector) {
 | 
			
		||||
  if (!$(selector).length) return;
 | 
			
		||||
  if (!$.find(selector).length) return;
 | 
			
		||||
  // Create label
 | 
			
		||||
  const $newLabelPanel = $('.new-label.segment');
 | 
			
		||||
  $('.new-label.button').on('click', () => {
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user