Merge commit from fork

Fix a few reflected XSS vulnerabilities
TracksApp · Jul 25, 2024 · 75420d9 · 75420d9
2 parents 6a4a722 + b0d288d
commit 75420d9
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 10 deletions.
diff --git a/app/controllers/todos_controller.rb b/app/controllers/todos_controller.rb
@@ -863,8 +863,10 @@ def get_params_for_tag_view
     end
 
     @single_tag = @tag_expr.size == 1 && @tag_expr[0].size == 1
-    @tag_name = @tag_expr[0][0]
-    @tag_title = @single_tag ? @tag_name : tag_title(@tag_expr)
+
+    # These are used in the templates, sanitise to prevent XSS.
+    @tag_name = sanitize(@tag_expr[0][0])
+    @tag_title = sanitize(@single_tag ? @tag_name : tag_title(@tag_expr))
   end
 
   def filter_format_for_tag_view

diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
@@ -7,14 +7,14 @@
     <%= javascript_include_tag "application" %>
     <%= csrf_meta_tags %>
     <script type="text/javascript">
-      var SOURCE_VIEW = '<%=@source_view%>';
-      var AUTH_TOKEN = '<%= raw(protect_against_forgery? ? form_authenticity_token.inspect : "") %>'
-      var TAG_NAME = '<%= @tag_name ? @tag_name : "" %>'
-      var GROUP_VIEW_BY = '<%= @group_view_by ? @group_view_by : "" %>'
+      var SOURCE_VIEW = '<%=j @source_view %>';
+      var AUTH_TOKEN = '<%=j raw(protect_against_forgery? ? form_authenticity_token.inspect : "") %>'
+      var TAG_NAME = '<%=j @tag_name ? @tag_name : "" %>'
+      var GROUP_VIEW_BY = '<%=j @group_view_by ? @group_view_by : "" %>'
       var defaultContexts = <%= default_contexts_for_autocomplete.html_safe rescue '{}' %>;
       var defaultTags = <%= default_tags_for_autocomplete.html_safe rescue '{}' %>;
-      var dateFormat = '<%= date_format_for_date_picker %>';
-      var weekStart = '<%= current_user.prefs.week_starts %>';
+      var dateFormat = '<%=j date_format_for_date_picker %>';
+      var weekStart = '<%=j current_user.prefs.week_starts %>';
       function relative_to_root(path) { return '<%= root_url %>'+path; };
       <% if current_user.prefs.refresh != 0 -%>
         setup_auto_refresh(<%= current_user.prefs["refresh"].to_i*60000 %>);

diff --git a/app/views/stats/show_selection_from_chart.html.erb b/app/views/stats/show_selection_from_chart.html.erb
@@ -4,8 +4,8 @@
     unless @further
 -%>
 <%= raw t('stats.click_to_show_actions_from_week',
-      :link => link_to("here", show_actions_from_chart_path(:id=>"#{params[:id]}_end", :index => params[:index])),
-      :week => params[:index])
+      :link => link_to("here", show_actions_from_chart_path(:id=>"#{params[:id].to_i}_end", :index => params[:index].to_i)),
+      :week => params[:index].to_i)
 -%>
 <%
     end