Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

FIX: Ensure theme names are escaped in HTML attributes (#15272) 

If a theme name contained a double-quote, this problem could lead to invalid/unexpected HTML in the `<head>`

Note that this is not considered a security issue because themes can only be installed/named by administrators, and themes/administrators already have the ability to run arbitrary javascript.
This commit is contained in:
David Taylor 2021-12-13 10:50:09 +00:00 committed by GitHub
parent bc6bff0e5a
commit 6e9bb84d12
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/stylesheet/manager.rb
View File

@ -195,7 +195,7 @@ class Stylesheet::Manager
theme_id = stylesheet[:theme_id]
data_theme_id = theme_id ? "data-theme-id=\"#{theme_id}\"" : ""
theme_name = stylesheet[:theme_name]
data_theme_name = theme_name ? "data-theme-name=\"#{theme_name}\"" : ""
data_theme_name = theme_name ? "data-theme-name=\"#{CGI.escapeHTML(theme_name)}\"" : ""
%[<link href="#{href}" media="#{media}" rel="stylesheet" data-target="#{target}" #{data_theme_id} #{data_theme_name}/>]
end.join("\n").html_safe
end

14
spec/components/stylesheet/manager_spec.rb
View File

@ -135,6 +135,20 @@ describe Stylesheet::Manager do
)
end
it "includes the escaped theme name" do
manager = manager(theme.id)
theme.update(name: "a strange name\"with a quote in it")
tag = manager.stylesheet_link_tag(:desktop_theme)
expect(tag).to have_tag("link", with: {
"data-theme-name" => theme.name.downcase
})
expect(tag).to have_tag("link", with: {
"data-theme-name" => child_theme.name.downcase
})
end
context "stylesheet order" do
let(:z_child_theme) do
Fabricate(:theme, component: true, name: "ze component").tap do |z|