From 0cea69daed2c9f8ce2ca370e71c970521c97c420 Mon Sep 17 00:00:00 2001 From: Echo Date: Wed, 2 Jul 2025 19:37:03 -0400 Subject: [PATCH] escape more things --- .../controllers/currently_hacking_controller.js | 11 ++++++++++- app/views/admin/admin_api_keys/index.html.erb | 4 ++-- app/views/admin/timeline/show.html.erb | 6 +++--- app/views/my/mailing_addresses/show.html.erb | 10 +++++----- .../_filterable_dashboard_content.html.erb | 2 +- app/views/static_pages/_project_durations.html.erb | 6 +++--- app/views/static_pages/index.html.erb | 8 ++++---- app/views/users/edit.html.erb | 2 +- 8 files changed, 29 insertions(+), 20 deletions(-) diff --git a/app/javascript/controllers/currently_hacking_controller.js b/app/javascript/controllers/currently_hacking_controller.js index e771a03..f6e76cf 100644 --- a/app/javascript/controllers/currently_hacking_controller.js +++ b/app/javascript/controllers/currently_hacking_controller.js @@ -186,12 +186,21 @@ export default class extends Controller { const v = p.repo_url ? p.repo_url.replace(/^https:\/\/github\.com\//, 'https://tkww0gcc0gkwwo4gc8kgs0sw.a.selfhosted.hackclub.com/') : '' + const out = this.esc(p.name) + return `
working on - ${p.repo_url ? `${p.name}` : p.name} + ${p.repo_url ? `${out}` : out} ${v ? `🌌` : ''}
` } + + esc(str) { + if (str === null || str === undefined) return ''; + return str.toString().replace(/[&<>"']/g, function (match) { + return { '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' }[match]; + }); + } } diff --git a/app/views/admin/admin_api_keys/index.html.erb b/app/views/admin/admin_api_keys/index.html.erb index b2f2814..3998e8e 100644 --- a/app/views/admin/admin_api_keys/index.html.erb +++ b/app/views/admin/admin_api_keys/index.html.erb @@ -30,7 +30,7 @@
- <%= api_key.name %> + <%= h(api_key.name) %>
@@ -39,7 +39,7 @@ <% end %>
-
<%= api_key.user.display_name %>
+
<%= h(api_key.user.display_name) %>
ID: <%= api_key.user.id %>
diff --git a/app/views/admin/timeline/show.html.erb b/app/views/admin/timeline/show.html.erb index 4a5127d..3c6d25f 100644 --- a/app/views/admin/timeline/show.html.erb +++ b/app/views/admin/timeline/show.html.erb @@ -167,7 +167,7 @@
+ title="User ID: <%= user.id %> - <%= user.respond_to?(:username) && user.username.present? ? h(user.username) : h(user.email_addresses.first&.email) %> | Total Coded: <%= total_coded_time_seconds && total_coded_time_seconds > 0 ? short_time_detailed(total_coded_time_seconds) : '0m' %> | TZ: <%= h(user.timezone) %>">
<%= render "shared/user_mention", user: user %>
@@ -291,9 +291,9 @@ <% if project_detail[:repo_url].present? %> <%= project_detail[:name].truncate(20) %> + title="Open <%= h(project_detail[:name]) %> on GitHub"><%= h(project_detail[:name]).truncate(20) %> <% else %> - <%= project_detail[:name].truncate(20) %> 🚫 + <%= h(project_detail[:name]).truncate(20) %> 🚫 <% end %> <% if p_idx < props[:projects_to_display].length - 1 && props[:height_px] > 20 %> <%= " / " %> diff --git a/app/views/my/mailing_addresses/show.html.erb b/app/views/my/mailing_addresses/show.html.erb index d6e01a9..19acb87 100644 --- a/app/views/my/mailing_addresses/show.html.erb +++ b/app/views/my/mailing_addresses/show.html.erb @@ -23,16 +23,16 @@

- <%= @user.mailing_address.first_name %> <%= @user.mailing_address.last_name %> + <%= h(@user.mailing_address.first_name) %> <%= h(@user.mailing_address.last_name) %>

-

<%= @user.mailing_address.line_1 %>

+

<%= h(@user.mailing_address.line_1) %>

<% if @user.mailing_address.line_2.present? %> -

<%= @user.mailing_address.line_2 %>

+

<%= h(@user.mailing_address.line_2) %>

<% end %>

- <%= @user.mailing_address.city %>, <%= @user.mailing_address.state %> <%= @user.mailing_address.zip_code %> + <%= h(@user.mailing_address.city) %>, <%= h(@user.mailing_address.state) %> <%= h(@user.mailing_address.zip_code) %>

-

<%= @user.mailing_address.country %>

+

<%= h(@user.mailing_address.country) %>

diff --git a/app/views/static_pages/_filterable_dashboard_content.html.erb b/app/views/static_pages/_filterable_dashboard_content.html.erb index 84ddfc9..c549de5 100644 --- a/app/views/static_pages/_filterable_dashboard_content.html.erb +++ b/app/views/static_pages/_filterable_dashboard_content.html.erb @@ -86,7 +86,7 @@ <% @project_durations.each do |project, duration| %>
-
<%= (project.presence || "Unknown") %>
+
<%= h(project.presence || "Unknown") %>
<%= ApplicationController.helpers.short_time_simple(duration) %> diff --git a/app/views/static_pages/_project_durations.html.erb b/app/views/static_pages/_project_durations.html.erb index 1825e69..e5b4005 100644 --- a/app/views/static_pages/_project_durations.html.erb +++ b/app/views/static_pages/_project_durations.html.erb @@ -7,8 +7,8 @@
-

- <%= (project[:project].presence || "Unknown") %> +

+ <%= h(project[:project].presence || "Unknown") %>

<% if project[:repository]&.stars.present? %>
@@ -59,7 +59,7 @@ <% if project[:repository]&.description.present? %>
- <%= project[:repository].description %> + <%= h(project[:repository].description) %>
<% end %> diff --git a/app/views/static_pages/index.html.erb b/app/views/static_pages/index.html.erb index b2c384e..81df44f 100644 --- a/app/views/static_pages/index.html.erb +++ b/app/views/static_pages/index.html.erb @@ -68,10 +68,10 @@ <% @ssp_users_recent.each_with_index do |user, index| %>
- <%= user[:display_name] %> + <%= h(user[:display_name]) %>
<% end %> <% if @ssp_users_size && @ssp_users_size > 5 %> @@ -82,8 +82,8 @@
<% @ssp_users_recent.each do |user| %>
- <%= user[:display_name] %> - <%= user[:display_name] %> + <%= h(user[:display_name]) %> + <%= h(user[:display_name]) %>
<% end %>
diff --git a/app/views/users/edit.html.erb b/app/views/users/edit.html.erb index 706c491..74c82e7 100644 --- a/app/views/users/edit.html.erb +++ b/app/views/users/edit.html.erb @@ -246,7 +246,7 @@