Removes useless escapes from ppNix in options page.
#229
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
As reported on IRC by @infinisil |
edolstra
reviewed
Jul 2, 2018
nixos/options.tt
Outdated
| @@ -243,7 +243,7 @@ function ppNix(indent, v) { | |||
| } | |||
|
|
|||
| if (typeof v == "string") { | |||
| v = v.replace('<', '<').replace('>', '>'); | |||
| v = v; | |||
There was a problem hiding this comment.
You're right, I removed the same pattern from both location (and tested both cases) but didn't stop and look at what was left at the second location. It's now fixed.
This is safe since all calls to `ppNix` are made using `.text()`. * https://github.com/NixOS/nixos-homepage/blob/f74049df65db247ce156022155a966c272ffb96c/nixos/options.tt#L324-L328 And *anyway* the previous escapes were done only one time, making it trivial to bypass ``` > "<<<<<".replace("<", ">") → "><<<<" ``` This has further been manually verified (with an hand-modified options.json) to not cause opportunities for HTML injection.
samueldr
force-pushed
the
fix/useless-escaping
branch
from
f107218
to
67c615f
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is safe since all calls to
ppNixare made using.text().nixos-homepage/nixos/options.tt
Lines 324 to 328 in f74049d
And anyway the previous escapes were done only one time, making it
trivial to bypass
This has further been manually verified (with an hand-modified options.json) to
not cause opportunities for HTML injection.