Issue #421: Able to embed inline javascript in sticky note widget - fedora-hubs

Currently, we are not sanitizing the input from the user when rendering the sticky widget. If you add something like the following:

<a onClick="alert('pants');" href="#">and some more</a>

to a sticky note widget, it runs the script.

I'll fix this!

in other fedora apps, we use bleach to do this:

https://github.com/fedora-infra/bodhi/blob/develop/bodhi/server/util.py#L434

Metadata Update from @ryanlerch:
- Issue priority set to: High

Nov 2, 2017

Fixed by changeset c78e0cae in PR #422.

Edited Nov 6, 2017 by abompard

Metadata Update from @abompard:
- Issue assigned to shaily
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

Nov 6, 2017

Assignee

shaily

Tags

None

Blocking

None

Depending on

None

Priority

Lowest