Skip to content

Commit 34d8431

Browse files
committed
Revert "Fix XSS vulnerability in the list view"
This reverts commit d84b398. Because it's causing a functional issue, as well as being unnecessary. Refs. #3686 (comment)
1 parent 44e7643 commit 34d8431

File tree

2 files changed

+1
-13
lines changed

2 files changed

+1
-13
lines changed

app/views/rails_admin/main/index.html.haml

+1-1
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@
103103
%td.other.left= link_to "...", @other_left_link, class: 'pjax'
104104
- properties.map{ |property| property.bind(:object, object) }.each do |property|
105105
- value = property.pretty_value
106-
%td{class: "#{property.css_class} #{property.type_css_class}", title: value}= value
106+
%td{class: "#{property.css_class} #{property.type_css_class}", title: strip_tags(value.to_s)}= value
107107
- if @other_right_link ||= other_right && index_path(params.merge(set: (params[:set].to_i + 1)))
108108
%td.other.right= link_to "...", @other_right_link, class: 'pjax'
109109
- unless frozen_columns

spec/integration/actions/index_spec.rb

-12
Original file line numberDiff line numberDiff line change
@@ -654,18 +654,6 @@
654654
visit index_path(model_name: 'team')
655655
expect(find('tbody tr:nth-child(1) td:nth-child(4)')).to have_content(@players.sort_by(&:id).collect(&:name).join(', '))
656656
end
657-
658-
it 'does not allow XSS for title attribute' do
659-
RailsAdmin.config Team do
660-
list do
661-
field :name
662-
end
663-
end
664-
@team = FactoryBot.create :team, name: '" onclick="alert()" "'
665-
visit index_path(model_name: 'team')
666-
expect(find('tbody tr:nth-child(1) td:nth-child(2)')['onclick']).to be_nil
667-
expect(find('tbody tr:nth-child(1) td:nth-child(2)')['title']).to eq '" onclick="alert()" "'
668-
end
669657
end
670658

671659
context 'without pagination' do

0 commit comments

Comments
 (0)