From fa622ebffc5b6faf7aae40f57a6e9e78a201cc57 Mon Sep 17 00:00:00 2001 From: Alan Guo Xiang Tan Date: Thu, 5 Jan 2023 06:20:35 +0800 Subject: [PATCH] SECURITY: escape quotes in tag description when rendering (#19742) Co-authored-by: Daniel Waterworth --- app/assets/javascripts/discourse/app/lib/render-tag.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/assets/javascripts/discourse/app/lib/render-tag.js b/app/assets/javascripts/discourse/app/lib/render-tag.js index 418b37f1b4..d0fbb81515 100644 --- a/app/assets/javascripts/discourse/app/lib/render-tag.js +++ b/app/assets/javascripts/discourse/app/lib/render-tag.js @@ -2,6 +2,7 @@ import User from "discourse/models/user"; import { escapeExpression } from "discourse/lib/utilities"; import getURL from "discourse-common/lib/get-url"; import { helperContext } from "discourse-common/lib/helpers"; +import { escape } from "pretty-text/sanitizer"; let _renderer = defaultRenderTag; @@ -44,7 +45,7 @@ export function defaultRenderTag(tag, params) { href + " data-tag-name=" + tag + - (params.description ? ' title="' + params.description + '" ' : "") + + (params.description ? ' title="' + escape(params.description) + '" ' : "") + " class='" + classes.join(" ") + "'>" +