Merge pull request #16611 from nextcloud/backport/16599/stable15

rullzer · web-flow · commit 862ca2134c10 · 2019-07-30T16:30:32.000+02:00
[stable15] Fix/xss/on favorite file
diff --git a/apps/files/js/tagsplugin.js b/apps/files/js/tagsplugin.js
@@ -103,7 +103,7 @@
 		var innerTagA = document.createElement('A');
 		innerTagA.setAttribute("href", url);
 		innerTagA.setAttribute("class", "nav-icon-files svg");
-		innerTagA.innerHTML = appName;
+		innerTagA.innerHTML = _.escape(appName);
 
 		var length = listLIElements.length + 1;
 		var innerTagLI = document.createElement('li');
diff --git a/apps/theming/js/3rdparty/jscolor/jscolor.js b/apps/theming/js/3rdparty/jscolor/jscolor.js
@@ -1100,7 +1100,7 @@ var jsc = {
 				if (jsc.isElementType(this.valueElement, 'input')) {
 					this.valueElement.value = value;
 				} else {
-					this.valueElement.innerHTML = value;
+					this.valueElement.innerHTML = _.escape(value);
 				}
 			}
 			if (!(flags & jsc.leaveStyle)) {

Original file line number	Diff line number	Diff line change
`@@ -1100,7 +1100,7 @@ var jsc = {`
`1100`	`1100`	`if (jsc.isElementType(this.valueElement, 'input')) {`
`1101`	`1101`	`this.valueElement.value = value;`
`1102`	`1102`	`} else {`
`1103`		`- this.valueElement.innerHTML = value;`
	`1103`	`+ this.valueElement.innerHTML = _.escape(value);`
`1104`	`1104`	`}`
`1105`	`1105`	`}`
`1106`	`1106`	`if (!(flags & jsc.leaveStyle)) {`