[PPP-5351]-XSS Findings For Data-Access ,Pentaho-platform-plugin-dash…

…boards
pentaho · Oct 28, 2024 · a6c46ee · a6c46ee
1 parent 7c1b5fa
commit a6c46ee
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/assemblies/data-access-plugin/src/main/resources/resources/web/messages/Messages.js b/assemblies/data-access-plugin/src/main/resources/resources/web/messages/Messages.js
@@ -12,9 +12,10 @@
 * without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU Lesser General Public License for more details.
 *
-* Copyright (c) 2002-2017 Hitachi Vantara..  All rights reserved.
+* Copyright (c) 2002-2024 Hitachi Vantara..  All rights reserved.
 */
 
+define(["common-ui/util/xss"], function(xssUtil) {
 Messages = function()
 {
 };
@@ -49,7 +50,7 @@ Messages.entityDecoder=document.createElement('textarea');
 Messages.html_entity_decode = function(str)
 {
     try{
-        Messages.entityDecoder.innerHTML = str; 
+        xssutil.setHtml(Messages.entityDecoder, str)
         var value = Messages.entityDecoder.value;
         value = unescape(value);
         return value;
@@ -117,8 +118,9 @@ var cnt = 0;
 		element = elementOrId;
 	}
 	if (element) {
-		element.innerHTML = Messages.getString(msgKey);
+		xssutil.setHtml(element, Messages.getString(msgKey));
 	}
 };
 /* static init */
 Messages.init();
+});