HTML tag are not escape when displaying job parameter description (OD-1254)

bufferUnderrun opened 3 years ago

Hi,

there is some potential injection in job parameter description

I set a parameter definition with html tag. Why : just for explaining that this parameter will be overriden using following pattern.

When running job, the parameters modal display raw description value

thanks

OneDev changed state to 'Closed' 3 years ago
Previous Value Current Value
Open

Closed
OneDev commented 3 years ago

State changed as code fixing the issue is committed (394c1a89)
OneDev changed state to 'Released' 3 years ago
Previous Value Current Value
Closed

Released
OneDev commented 3 years ago

State changed as build #3492 is successful
Robin Shen commented 3 years ago

Param description can still contain html tags in 8.0.7. However it will be sanitized to avoid potential XSS attack.

To use special html characters, use the escape form, for instance < for <
Login to comment

Previous Value	Current Value
Open	Closed

Previous Value	Current Value
Closed	Released

Issue Votes (0)

Watchers (3)

Reference

OD-1254