mirrors/jellyfin-web
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin-web synced 2025-03-30 19:56:21 +00:00
Code Activity

Fix XSS in card aria labels

Browse source
This commit is contained in:
Bill Thornton 2022-08-02 13:51:20 -04:00
parent 2feaff3648
commit eb4159788d
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/components/cardbuilder/cardBuilder.js
View file

@ -1347,7 +1347,7 @@ import ServerConnections from '../ServerConnections';
cardImageContainerClose = '</div>'; cardImageContainerClose = '</div>';
} else { } else {
const cardImageContainerAriaLabelAttribute = ` aria-label="${item.Name}"`; const cardImageContainerAriaLabelAttribute = ` aria-label="${escapeHtml(item.Name)}"`;
// Don't use the IMG tag with safari because it puts a white border around it // Don't use the IMG tag with safari because it puts a white border around it
cardImageContainerOpen = imgUrl ? ('<button data-action="' + action + '" class="' + cardImageContainerClass + ' ' + cardContentClass + ' itemAction lazy" data-src="' + imgUrl + '" ' + blurhashAttrib + cardImageContainerAriaLabelAttribute + '>') : ('<button data-action="' + action + '" class="' + cardImageContainerClass + ' ' + cardContentClass + ' itemAction"' + cardImageContainerAriaLabelAttribute + '>'); cardImageContainerOpen = imgUrl ? ('<button data-action="' + action + '" class="' + cardImageContainerClass + ' ' + cardContentClass + ' itemAction lazy" data-src="' + imgUrl + '" ' + blurhashAttrib + cardImageContainerAriaLabelAttribute + '>') : ('<button data-action="' + action + '" class="' + cardImageContainerClass + ' ' + cardContentClass + ' itemAction"' + cardImageContainerAriaLabelAttribute + '>');
@ -1430,7 +1430,7 @@ import ServerConnections from '../ServerConnections';
if (tagName === 'button') { if (tagName === 'button') {
className += ' itemAction'; className += ' itemAction';
actionAttribute = ' data-action="' + action + '"'; actionAttribute = ' data-action="' + action + '"';
ariaLabelAttribute = ` aria-label="${item.Name}"`; ariaLabelAttribute = ` aria-label="${escapeHtml(item.Name)}"`;
} else { } else {
actionAttribute = ''; actionAttribute = '';
} }