kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

[ruby/rdoc] Escape search results

Browse source 
https://hackerone.com/reports/1321358

https://github.com/ruby/rdoc/commit/2ebf8fd510
This commit is contained in:
Nobuyoshi Nakada 2021-09-07 23:52:13 +09:00 committed by git
parent a3cb09c7d1
commit 39909d8c18
3 changed files with 12 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
lib/rdoc/generator/template/darkfish/_head.rhtml
View file

@ -3,18 +3,18 @@
<title><%= h @title %></title>
<script type="text/javascript">
var rdoc_rel_prefix = "<%= asset_rel_prefix %>/";
var index_rel_prefix = "<%= rel_prefix %>/";
var rdoc_rel_prefix = "<%= h asset_rel_prefix %>/";
var index_rel_prefix = "<%= h rel_prefix %>/";
</script>
<script src="<%= asset_rel_prefix %>/js/navigation.js" defer></script>
<script src="<%= asset_rel_prefix %>/js/search.js" defer></script>
<script src="<%= asset_rel_prefix %>/js/search_index.js" defer></script>
<script src="<%= asset_rel_prefix %>/js/searcher.js" defer></script>
<script src="<%= asset_rel_prefix %>/js/darkfish.js" defer></script>
<script src="<%= h asset_rel_prefix %>/js/navigation.js" defer></script>
<script src="<%= h asset_rel_prefix %>/js/search.js" defer></script>
<script src="<%= h asset_rel_prefix %>/js/search_index.js" defer></script>
<script src="<%= h asset_rel_prefix %>/js/searcher.js" defer></script>
<script src="<%= h asset_rel_prefix %>/js/darkfish.js" defer></script>
<link href="<%= asset_rel_prefix %>/css/fonts.css" rel="stylesheet">
<link href="<%= asset_rel_prefix %>/css/rdoc.css" rel="stylesheet">
<link href="<%= h asset_rel_prefix %>/css/fonts.css" rel="stylesheet">
<link href="<%= h asset_rel_prefix %>/css/rdoc.css" rel="stylesheet">
<%- @options.template_stylesheets.each do |stylesheet| -%>
<link href="<%= asset_rel_prefix %>/<%= File.basename stylesheet %>" rel="stylesheet">
<link href="<%= h asset_rel_prefix %>/<%= File.basename stylesheet %>" rel="stylesheet">
<%- end -%>

2
lib/rdoc/generator/template/darkfish/js/darkfish.js
View file

@ -54,7 +54,7 @@ function hookSearch() {
var html = '';
// TODO add relative path to <script> per-page
html += '<p class="search-match"><a href="' + index_rel_prefix + result.path + '">' + this.hlt(result.title);
html += '<p class="search-match"><a href="' + index_rel_prefix + this.escapeHTML(result.path) + '">' + this.hlt(result.title);
if (result.params)
html += '<span class="params">' + result.params + '</span>';
html += '</a>';

2
lib/rdoc/generator/template/darkfish/js/search.js
View file

@ -101,7 +101,7 @@ Search.prototype = Object.assign({}, Navigation, new function() {
}
this.escapeHTML = function(html) {
return html.replace(/[&<>]/g, function(c) {
return html.replace(/[&<>"`']/g, function(c) {
return '&#' + c.charCodeAt(0) + ';';
});
}