vassili/seitime-frappe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: Prevent HTML injection in Button attributes and documentation_url (#31188)

Browse source 
* fix: Prevent HTML injection in Button attributes

* fix: Prevent HTML injection in documentation_url
This commit is contained in:
Corentin Forler 2025-02-11 10:46:30 +01:00 • committed by GitHub
parent f040fb446c
commit dd876a36c5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
frappe/public/js/frappe/form/controls/base_input.js
View file

@ -189,7 +189,11 @@ frappe.ui.form.ControlInput = class ControlInput extends frappe.ui.form.Control
let $help = this.$wrapper.find("span.help");
$help.empty();
$(`<a href="${this.df.documentation_url}" target="_blank" title="${__("Documentation")}">
$(`<a
href="${frappe.utils.escape_html(this.df.documentation_url)}"
target="_blank"
title="${frappe.utils.escape_html(__("Documentation"))}"
>
${frappe.utils.icon("help", "sm")}
</a>`).appendTo($help);
}

5
frappe/public/js/frappe/form/controls/button.js
View file

@ -8,7 +8,10 @@ frappe.ui.form.ControlButton = class ControlButton extends frappe.ui.form.Contro
const btn_type = this.df.primary ? "btn-primary" : "btn-default";
const btn_size = this.df.btn_size ? `btn-${this.df.btn_size}` : "btn-xs";
this.$input = $(
`<button class="btn ${btn_size} ${btn_type} ellipsis" title="${this.df.label}">`
`<button
class="btn ${frappe.utils.escape_html(btn_size)} ${frappe.utils.escape_html(btn_type)} ellipsis"
title="${frappe.utils.escape_html(this.df.label)}"
>`
)
.prependTo(me.input_area)
.on("click", function () {