Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Removing HTML from component tooltips #5121

Draft
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

robinmolen
Copy link
Contributor

Closes open-formulieren/security-issues#36

Changes

Added a simplistic sanitize function that sanitizes component data when saving the component. This function removes all HTML content from the component tooltip.

Checklist

Check off the items that are completed or not relevant.

  • Impact on features

    • Checked copying a form
    • Checked import/export of a form
    • Config checks in the configuration overview admin page
    • Problem detection in the admin email digest is handled
  • Release management

    • I have labelled the PR as "needs-backport" accordingly
  • I have updated the translations assets (you do NOT need to provide translations)

    • Ran ./bin/makemessages_js.sh
    • Ran ./bin/compilemessages_js.sh
  • Dockerfile/scripts

    • Updated the Dockerfile with the necessary scripts from the ./bin folder
  • Commit hygiene

    • Commit messages refer to the relevant Github issue
    • Commit messages explain the "why" of change, not the how

Copy link

codecov bot commented Feb 25, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 96.73%. Comparing base (e7e8155) to head (eb970b1).
Report is 14 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #5121   +/-   ##
=======================================
  Coverage   96.73%   96.73%           
=======================================
  Files         775      775           
  Lines       26662    26664    +2     
  Branches     3468     3469    +1     
=======================================
+ Hits        25792    25794    +2     
  Misses        608      608           
  Partials      262      262           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@robinmolen robinmolen force-pushed the issue/html-in-component-tooltip branch from eb0dee1 to eb578a3 Compare February 26, 2025 08:22
…data

Added a simplistic sanitize function that sanitizes component data when saving the component. This function removes most HTML content from the label, tooltip, description and placeholder component data. Only basic semantic tags (`a`, `b`, `em`, `i`, `string`, `u`) are allowed. Also the allowed attributes has been limited to `href` on `a` tags.
@robinmolen robinmolen force-pushed the issue/html-in-component-tooltip branch from eb578a3 to fa13953 Compare February 27, 2025 08:55
@robinmolen robinmolen marked this pull request as ready for review February 27, 2025 08:58
@robinmolen robinmolen marked this pull request as draft February 27, 2025 09:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant