Update documentation #250
Update documentation #250
Conversation
cjlapao
requested review from
alevlasu,
bineesh-n and
polonius
as code owners
boring-cyborg
bot
added
the
documentation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| $el.each(function(i) { | ||
| var title = $(this).attr('title'); | ||
| if (title) { | ||
| $insert.append("<li class=\"tab\"><a href=\"#\">" + title + "</a></li>"); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium documentation
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 22 days ago
To fix the problem, we need to ensure that the title attribute is properly escaped before being inserted into the HTML string. This can be done using a utility function that escapes special HTML characters. We will create a function to escape the title attribute and use it in the listLanguages function.
| @@ -110,2 +110,13 @@ | ||
|
|
||
| function escapeHtml(text) { | ||
| var map = { | ||
| '&': '&', | ||
| '<': '<', | ||
| '>': '>', | ||
| '"': '"', | ||
| "'": ''' | ||
| }; | ||
| return text.replace(/[&<>"']/g, function(m) { return map[m]; }); | ||
| } | ||
|
|
||
| function listLanguages($el, $insert) { | ||
| @@ -114,3 +125,3 @@ | ||
| if (title) { | ||
| $insert.append("<li class=\"tab\"><a href=\"#\">" + title + "</a></li>"); | ||
| $insert.append("<li class=\"tab\"><a href=\"#\">" + escapeHtml(title) + "</a></li>"); | ||
| } |
| $el.each(function(i) { | ||
| var title = $(this).attr('title'); | ||
| if (title) { | ||
| $insert.append("<li class=\"tab\"><a href=\"#\">" + title + "</a></li>"); |
Check warning
Code scanning / CodeQL
DOM text reinterpreted as HTML Medium documentation
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 22 days ago
To fix the problem, we need to ensure that the title attribute is properly escaped before being inserted into the HTML. This can be achieved by using a function that escapes special HTML characters, preventing any potential XSS attacks.
The best way to fix this without changing existing functionality is to create a utility function that escapes HTML characters and use it to sanitize the title attribute before concatenating it into the HTML string.
| @@ -110,2 +110,17 @@ | ||
|
|
||
| function escapeHtml(text) { | ||
| return text.replace(/[&<>"'`=\/]/g, function (s) { | ||
| return ({ | ||
| '&': '&', | ||
| '<': '<', | ||
| '>': '>', | ||
| '"': '"', | ||
| "'": ''', | ||
| '/': '/', | ||
| '`': '`', | ||
| '=': '=' | ||
| })[s]; | ||
| }); | ||
| } | ||
|
|
||
| function listLanguages($el, $insert) { | ||
| @@ -114,3 +129,3 @@ | ||
| if (title) { | ||
| $insert.append("<li class=\"tab\"><a href=\"#\">" + title + "</a></li>"); | ||
| $insert.append("<li class=\"tab\"><a href=\"#\">" + escapeHtml(title) + "</a></li>"); | ||
| } |
No description provided.