[PPP-5353]-XSS Findings For Pentaho-platform-plugin-reporting #874
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This comment has been minimized.
This comment has been minimized.
Rangashivani
force-pushed
the
BACKLOG-41215
branch
from
e3d57d8 to
997c685
Compare
This comment has been minimized.
This comment has been minimized.
Rangashivani
force-pushed
the
BACKLOG-41215
branch
from
997c685 to
4f72607
Compare
This comment has been minimized.
This comment has been minimized.
Rangashivani
force-pushed
the
BACKLOG-41215
branch
from
4f72607 to
3b8ea76
Compare
This comment has been minimized.
This comment has been minimized.
dcleao
requested changes
Nov 21, 2024
| @@ -818,7 +818,7 @@ define([ 'common-ui/util/util', 'common-ui/util/timeutil', 'common-ui/util/forma | |||
| if(isRunningIFrameInSameOrigin) { | |||
| if (!top.mantle_initialized) { | |||
| this._topMantleOpenTabRegistration = top.mantle_openTab = function(name, title, url) { | |||
| window.open(url, '_blank'); | |||
| window.open(xssUtil.sanitizeUrl(url), '_blank'); | |||
There was a problem hiding this comment.
Should use the new xssUtil.openWindow(..) method instead.
| @@ -1189,7 +1189,7 @@ define([ 'common-ui/util/util', 'common-ui/util/timeutil', 'common-ui/util/forma | |||
| hideDlgAndPane(registry.byId('feedbackScreen')); | |||
|
|
|||
| //Show loading screen | |||
| $('#notification-message').html(_Messages.getString('LoadingPage') + " " + mainJobStatus.page + " " + _Messages.getString('Of') + " " + mainJobStatus.totalPages); | |||
| $('#notification-message').html(xssUtil.sanitizeHtml(_Messages.getString('LoadingPage') + " " + mainJobStatus.page + " " + _Messages.getString('Of') + " " + mainJobStatus.totalPages)); | |||
There was a problem hiding this comment.
Should use the xssUtil.setHtml(..) method, after support for jQuery objects has been added to setHtml(..) and setHtmlUnsafe(..).
| @@ -1232,7 +1232,7 @@ define([ 'common-ui/util/util', 'common-ui/util/timeutil', 'common-ui/util/forma | |||
| isPageCountUpdated = true; | |||
| } | |||
|
|
|||
| $('#notification-message').html(_Messages.getString('LoadingPage') + " " + mainJobStatus.page + " " + _Messages.getString('Of') + " " + mainJobStatus.totalPages); | |||
| $('#notification-message').html(xssUtil.sanitizeHtml(_Messages.getString('LoadingPage') + " " + mainJobStatus.page + " " + _Messages.getString('Of') + " " + mainJobStatus.totalPages)); | |||
There was a problem hiding this comment.
Idem, for use of xssUtil.setHtml(...) given a jQuery object.
| @@ -1242,13 +1242,13 @@ define([ 'common-ui/util/util', 'common-ui/util/timeutil', 'common-ui/util/forma | |||
| case "QUEUED": | |||
| case "WORKING": | |||
| // Although we are hiding the screen latter, update the label anyway; | |||
| $('#notification-message').html(_Messages.getString('LoadingPage') + " " + mainJobStatus.page + " " + _Messages.getString('Of') + " " + mainJobStatus.totalPages); | |||
| $('#notification-message').html(xssUtil.sanitizeHtml(_Messages.getString('LoadingPage') + " " + mainJobStatus.page + " " + _Messages.getString('Of') + " " + mainJobStatus.totalPages)); | |||
There was a problem hiding this comment.
Idem, for use of xssUtil.setHtml(...) given a jQuery object.
|
New version of old PR, having unresolved comments: #864. |
Rangashivani
force-pushed
the
BACKLOG-41215
branch
from
3b8ea76 to
0e6eaa6
Compare
This comment has been minimized.
This comment has been minimized.
Rangashivani
force-pushed
the
BACKLOG-41215
branch
from
0e6eaa6 to
a05a08e
Compare
❌ Build failed in 3m 44sBuild command: mvn clean verify -B -e -Daudit -Djs.no.sandbox -pl core👌 All tests passed! Tests run: 540, Failures: 0, Skipped: 3 Test Results Errors:Filtered log (click to expand)
ℹ️ This is an automatic message |
dcleao
approved these changes
Dec 19, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
PPP-5353-XSS Findings For Pentaho-platform-plugin-reporting