Actions
Bug #19514
closed
JS in a node name is evaluated in the rule changes
Pull Request:
Severity:
UX impact:
User visibility:
Effort required:
Priority:
0
Name check:
To do
Fix check:
To do
Regression:
Description
If a node is named
<script>alert("test");</script>
and generated repairs reports, on the rule page, clicking over the changes in the compliance section will cause one "alert("test")" per repair reports
If the repair just happened, it is on the list of changes in the table in the bottom when clicking on compliance and is evaluated immediatly
It does not always happen (something there are JS error on the pages)
Updated by Nicolas CHARLES over 3 years ago
- Subject changed from JS in a node name is evaluated in the rule detail page to JS in a node name is evaluated in the rule changes
- Description updated (diff)
Updated by Vincent MEMBRÉ over 3 years ago
- Related to Bug #19456: Lack of HTML escaping in nodes list added
Updated by
Actions