sjw/pleroma
1
0
Fork 0
mirror of https://git.pleroma.social/sjw/pleroma.git synced 2025-01-20 15:00:46 +01:00
Code Issues Releases Wiki Activity

Merge remote-tracking branch 'upstream/develop' into neckbeard

Browse Source
This commit is contained in:
Your New SJW Waifu 2023-06-07 07:40:35 -05:00
commit 923a842c71
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
changelog.d/3901.security Normal file
View File

@ -0,0 +1 @@
Preload: Make generated JSON html-safe. It already was html safe because it only consists of config data that is base64 encoded, but this will keep it safe it that ever changes.

4
lib/pleroma/web/preload.ex
View File

@ -11,7 +11,7 @@ defmodule Pleroma.Web.Preload do
terms =
params
|> parser.generate_terms()
|> Enum.map(fn {k, v} -> {k, Base.encode64(Jason.encode!(v))} end)
|> Enum.map(fn {k, v} -> {k, Base.encode64(Jason.encode!(v, escape: :html_safe))} end)
|> Enum.into(%{})
Map.merge(acc, terms)
@ -19,7 +19,7 @@ defmodule Pleroma.Web.Preload do
rendered_html =
preload_data
|> Jason.encode!()
|> Jason.encode!(escape: :html_safe)
|> build_script_tag()
|> HTML.safe_to_string()