francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
91 lines
3.2 KiB
Diff
91 lines
3.2 KiB
Diff
From 0e97b155ff1b15bc3173118561316d8ea28ec9b7 Mon Sep 17 00:00:00 2001
|
|
From: Emmanuele Bassi <ebassi@gnome.org>
|
|
Date: Fri, 10 Oct 2025 17:06:22 +0100
|
|
Subject: [PATCH] Make sure to escape query strings
|
|
|
|
Unescaped query strings should not be passed to the HTML parser, to
|
|
avoid unwanted execution of JavaScript.
|
|
|
|
The query is shown in the header of the search results, so we can easily
|
|
split the header from the results; then we use a plain text node to
|
|
represent the query, and let the browser escape it.
|
|
|
|
See: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html
|
|
|
|
Fixes: #228
|
|
|
|
CVE: CVE-2025-11687
|
|
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gi-docgen/-/commit/c53d2640bfa5823bbdf33683d95c160267c0ec68]
|
|
|
|
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
|
|
---
|
|
gidocgen/templates/basic/search.js | 30 +++++++++++++++++++-----------
|
|
1 file changed, 19 insertions(+), 11 deletions(-)
|
|
|
|
diff --git a/gidocgen/templates/basic/search.js b/gidocgen/templates/basic/search.js
|
|
index 29c204f..628f0a6 100644
|
|
--- a/gidocgen/templates/basic/search.js
|
|
+++ b/gidocgen/templates/basic/search.js
|
|
@@ -182,17 +182,24 @@ function hideSearchResults() {
|
|
}
|
|
}
|
|
|
|
-function renderResults(query, results) {
|
|
- let html = "";
|
|
+function createResultsTitle(query, n_results) {
|
|
+ // Ensure we're returning an escaped query string, to ensure we
|
|
+ // prevent XSS vulnerabilities
|
|
+ let h1 = document.createElement("h1");
|
|
+ let text = document.createTextNode("Results for “" + query + "” (" + n_results + ")");
|
|
+ h1.appendChild(text)
|
|
+ return h1;
|
|
+}
|
|
|
|
- html += "<h1>Results for "" + query + "" (" + results.length + ")</h1>" +
|
|
- "<div id=\"search-results\">"
|
|
+function createResultsContent(results) {
|
|
+ let search_results = document.createElement("div");
|
|
+ search_results.setAttribute("id", "search-results");
|
|
|
|
if (results.length === 0) {
|
|
- html += "No results found.";
|
|
+ search_results.textContent = "No results found.";
|
|
}
|
|
else {
|
|
- html += "<div class=\"results\"><dl>";
|
|
+ let html = "<div class=\"results\"><dl>";
|
|
results.forEach(function(item) {
|
|
html += "<dt class=\"result " + TYPE_CLASSES[item.type] + "\">" +
|
|
"<a href=\"" + item.href + "\">" + item.text + "</a>" +
|
|
@@ -204,11 +211,11 @@ function renderResults(query, results) {
|
|
"<dd>" + item.summary + "</dd>";
|
|
});
|
|
html += "</dl></div>";
|
|
- }
|
|
|
|
- html += "</div>";
|
|
+ search_results.innerHTML = html;
|
|
+ }
|
|
|
|
- return html;
|
|
+ return search_results;
|
|
}
|
|
|
|
function showResults(query, results) {
|
|
@@ -218,9 +225,10 @@ function showResults(query, results) {
|
|
window.history.replaceState(refs.input.value, "", baseUrl + extra + window.location.hash);
|
|
}
|
|
|
|
- window.title = "Results for: " + query;
|
|
+ window.title = "Results for “" + query + "” (" + results.length + ")";
|
|
window.scroll({ top: 0 })
|
|
- refs.search.innerHTML = renderResults(query, results);
|
|
+ refs.search.appendChild(createResultsTitle(query, results.length));
|
|
+ refs.search.appendChild(createResultsContent(results));
|
|
showSearchResults(search);
|
|
}
|
|
|
|
--
|
|
2.50.0
|
|
|