Escape HTML in texts shown in DataTables

kiwitcms · Aug 30, 2018 · ca3e119 · ca3e119
1 parent 3149878
commit ca3e119
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 3 deletions.
diff --git a/tcms/static/js/utils.js b/tcms/static/js/utils.js
@@ -53,3 +53,25 @@ function updateParamsToSearchTags(selector, params) {
         params['tag__name__in'] = tag_list;
     };
 }
+
+
+/*
+    Replaces HTML characters for display in DataTables
+
+    backslash(\), quotes('), double quotes (")
+    https://github.com/kiwitcms/Kiwi/issues/78
+
+    angle brackets (<>)
+    https://github.com/kiwitcms/Kiwi/issues/234
+*/
+function escapeHTML(unsafe) {
+  return unsafe.replace(/[&<>"']/g, function(m) {
+    return ({
+      '&': '&amp;',
+      '<': '&lt;',
+      '>': '&gt;',
+      '"': '&quot;',
+      '\'': '&#039;'
+    })[m]
+  });
+}
diff --git a/tcms/testplans/static/testplans/js/search.js b/tcms/testplans/static/testplans/js/search.js
@@ -54,7 +54,7 @@ $(document).ready(function() {
             {
                 data: null,
                 render: function (data, type, full, meta) {
-                    return '<a href="/plan/'+ data.plan_id + '">' + data.name + '</a>';
+                    return '<a href="/plan/'+ data.plan_id + '/">' + escapeHTML(data.name) + '</a>';
                 }
             },
             { data: "create_date" },

diff --git a/tcms/testruns/static/testruns/js/search.js b/tcms/testruns/static/testruns/js/search.js
@@ -82,13 +82,13 @@ $(document).ready(function() {
             {
                 data: null,
                 render: function (data, type, full, meta) {
-                    return '<a href="/run/'+ data.run_id + '" target="_parent">' + data.summary + '</a>';
+                    return '<a href="/run/'+ data.run_id + '/" target="_parent">' + escapeHTML(data.summary) + '</a>';
                 }
             },
             {
                 data: null,
                 render: function (data, type, full, meta) {
-                    return '<a href="/plan/'+ data.plan_id + '" target="_parent">TP-' + data.plan_id + ': ' + data.plan + '</a>';
+                    return '<a href="/plan/'+ data.plan_id + '/" target="_parent">TP-' + data.plan_id + ': ' + escapeHTML(data.plan) + '</a>';
                 }
             },
             { data: "manager" },