Conversation
…loper experience of the api-docs across all RWS products. Make reference to: https://rws-dev.atlassian.net/wiki/spaces/LTApp/pages/930645143/Developer+Documentation+Improvement+Proposal
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| var itemBrief = extractContentBrief(hit.summary || ''); | ||
|
|
||
| var itemNode = $('<div>').attr('class', 'sr-item'); | ||
| var itemTitleNode = $('<div>').attr('class', 'item-title').append($('<a>').attr('href', itemHref).attr("target", "_blank").attr("rel", "noopener noreferrer").text(itemTitle)); |
Check failure
Code scanning / CodeQL
DOM text reinterpreted as HTML High
| } | ||
| event.preventDefault(); | ||
| info.anchor.href = 'javascript:'; | ||
| setTimeout(function () { return info.anchor.href = '#' + info.anchor.getAttribute('aria-controls'); }); |
Check failure
Code scanning / CodeQL
DOM text reinterpreted as HTML High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix the problem, we need to ensure that the value of the aria-controls attribute is properly sanitized before it is used. One way to do this is to use a function that escapes any potentially dangerous characters. This will prevent any malicious content from being interpreted as HTML.
We will create a utility function to escape HTML characters and use this function to sanitize the value of the aria-controls attribute before using it.
| @@ -3,2 +3,10 @@ | ||
| $(function () { | ||
| function escapeHtml(unsafe) { | ||
| return unsafe | ||
| .replace(/&/g, "&") | ||
| .replace(/</g, "<") | ||
| .replace(/>/g, ">") | ||
| .replace(/"/g, """) | ||
| .replace(/'/g, "'"); | ||
| } | ||
| var active = 'active'; | ||
| @@ -917,3 +925,3 @@ | ||
| info.anchor.href = 'javascript:'; | ||
| setTimeout(function () { return info.anchor.href = '#' + info.anchor.getAttribute('aria-controls'); }); | ||
| setTimeout(function () { return info.anchor.href = '#' + escapeHtml(info.anchor.getAttribute('aria-controls')); }); | ||
| var tabIds = info.tabIds, group = info.group; |
3 participants
No description provided.