From 3d9950792c0aef20643ce1c5f81670e1f7194af9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20L=C5=93uillet?= Date: Tue, 17 Jan 2017 10:09:04 +0100 Subject: Fixed possible JS injection via the title edition --- .../Resources/views/themes/baggy/Entry/entries.html.twig | 4 ++-- .../Resources/views/themes/baggy/Entry/entry.html.twig | 6 +++--- .../Resources/views/themes/common/Entry/entries.xml.twig | 2 +- .../Resources/views/themes/common/Entry/share.html.twig | 10 +++++----- .../views/themes/material/Entry/_card_full_image.html.twig | 4 ++-- .../views/themes/material/Entry/_card_no_preview.html.twig | 4 ++-- .../views/themes/material/Entry/_card_preview.html.twig | 8 ++++---- .../Resources/views/themes/material/Entry/entry.html.twig | 4 ++-- var/SymfonyRequirements.php | 6 +++++- 9 files changed, 26 insertions(+), 22 deletions(-) diff --git a/src/Wallabag/CoreBundle/Resources/views/themes/baggy/Entry/entries.html.twig b/src/Wallabag/CoreBundle/Resources/views/themes/baggy/Entry/entries.html.twig index 56a0faac..4679714e 100644 --- a/src/Wallabag/CoreBundle/Resources/views/themes/baggy/Entry/entries.html.twig +++ b/src/Wallabag/CoreBundle/Resources/views/themes/baggy/Entry/entries.html.twig @@ -23,7 +23,7 @@ {% for entry in entries %}
-

{{ entry.title|raw }}

+

{{ entry.title|e|raw }}

{% set readingTime = entry.readingTime / app.user.config.readingSpeed %}
@@ -60,7 +60,7 @@
  • {{ tag.label }}
  • {% endfor %} - {{ entry.title|raw }} + {{ entry.title|e|raw }} {% endif %}
    {% endfor %} diff --git a/src/Wallabag/CoreBundle/Resources/views/themes/baggy/Entry/entry.html.twig b/src/Wallabag/CoreBundle/Resources/views/themes/baggy/Entry/entry.html.twig index 3689159b..8ca194f6 100644 --- a/src/Wallabag/CoreBundle/Resources/views/themes/baggy/Entry/entry.html.twig +++ b/src/Wallabag/CoreBundle/Resources/views/themes/baggy/Entry/entry.html.twig @@ -1,11 +1,11 @@ {% extends "WallabagCoreBundle::layout.html.twig" %} -{% block title %}{{ entry.title|raw }} ({{ entry.domainName|removeWww }}){% endblock %} +{% block title %}{{ entry.title|e|raw }} ({{ entry.domainName|removeWww }}){% endblock %} {% block content %}
    -

    {{ entry.title|raw }}

    +

    {{ entry.title|e|raw }}

    @@ -67,7 +67,7 @@
    {% if entry.previewPicture is not null %} -
    {{ entry.title|raw }}
    +
    {{ entry.title|e|raw }}
    {% endif %}
    {{ entry.content | raw }} diff --git a/src/Wallabag/CoreBundle/Resources/views/themes/common/Entry/entries.xml.twig b/src/Wallabag/CoreBundle/Resources/views/themes/common/Entry/entries.xml.twig index 288bb54f..7103f22b 100644 --- a/src/Wallabag/CoreBundle/Resources/views/themes/common/Entry/entries.xml.twig +++ b/src/Wallabag/CoreBundle/Resources/views/themes/common/Entry/entries.xml.twig @@ -10,7 +10,7 @@ {% for entry in entries %} - <![CDATA[{{ entry.title }}]]> + <![CDATA[{{ entry.title|e }}]]> wallabag {{ entry.url }} {{ entry.url }} diff --git a/src/Wallabag/CoreBundle/Resources/views/themes/common/Entry/share.html.twig b/src/Wallabag/CoreBundle/Resources/views/themes/common/Entry/share.html.twig index f77264c6..623cf1c4 100644 --- a/src/Wallabag/CoreBundle/Resources/views/themes/common/Entry/share.html.twig +++ b/src/Wallabag/CoreBundle/Resources/views/themes/common/Entry/share.html.twig @@ -1,6 +1,6 @@ - {{ entry.title | raw }} + {{ entry.title|e|raw }} - + {% set picturePath = app.request.schemeAndHttpHost ~ asset('bundles/wallabagcore/themes/_global/img/logo-other_themes.png') %} @@ -38,13 +38,13 @@ - +
    -

    {{ entry.title | raw }}

    - +

    {{ entry.title|e|raw }}

    +
    {{ "entry.public.shared_by_wallabag"|trans({'%wallabag_instance%': url('homepage')})|raw }}
    diff --git a/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/_card_full_image.html.twig b/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/_card_full_image.html.twig index 0fdd5996..91a1bac0 100644 --- a/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/_card_full_image.html.twig +++ b/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/_card_full_image.html.twig @@ -11,8 +11,8 @@
    - - {{ entry.title | raw | striptags | truncate(80, true, '…') }} + + {{ entry.title | e | raw | striptags | truncate(80, true, '…') }} diff --git a/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/_card_no_preview.html.twig b/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/_card_no_preview.html.twig index 19a400b4..ed916e79 100644 --- a/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/_card_no_preview.html.twig +++ b/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/_card_no_preview.html.twig @@ -2,8 +2,8 @@
    - - {{ entry.title | raw | striptags | truncate(80, true, '…') }} + + {{ entry.title | e | raw | striptags | truncate(80, true, '…') }} diff --git a/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/_card_preview.html.twig b/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/_card_preview.html.twig index b0e3c06d..d23be4d0 100644 --- a/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/_card_preview.html.twig +++ b/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/_card_preview.html.twig @@ -13,8 +13,8 @@ more_vert - - {{ entry.title| striptags | truncate(80, true, '…') | raw }} + + {{ entry.title | e | striptags | truncate(80, true, '…') | raw }} @@ -29,8 +29,8 @@
    clear - - {{ entry.title | raw | striptags | truncate(80, true, '…') }} + + {{ entry.title | e | raw | striptags | truncate(80, true, '…') }} diff --git a/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/entry.html.twig b/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/entry.html.twig index c615a907..b445f7d5 100644 --- a/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/entry.html.twig +++ b/src/Wallabag/CoreBundle/Resources/views/themes/material/Entry/entry.html.twig @@ -1,6 +1,6 @@ {% extends "WallabagCoreBundle::layout.html.twig" %} -{% block title %}{{ entry.title|raw }} ({{ entry.domainName|removeWww }}){% endblock %} +{% block title %}{{ entry.title|e|raw }} ({{ entry.domainName|removeWww }}){% endblock %} {% block body_class %}entry{% endblock %} @@ -209,7 +209,7 @@ {% block content %}
    -

    {{ entry.title|raw }}

    +

    {{ entry.title|e|raw }}