Commit 15171a65 authored by Jason Song's avatar Jason Song

fix potential xss issue

parent a5a2c068
...@@ -731,9 +731,9 @@ ...@@ -731,9 +731,9 @@
"ItemModal.PleaseChooseCluster": "Please Select Cluster", "ItemModal.PleaseChooseCluster": "Please Select Cluster",
"ItemModal.ModifiedTips": "Update Successfully. need to release configuration to take effect", "ItemModal.ModifiedTips": "Update Successfully. need to release configuration to take effect",
"ItemModal.ModifyFailed": "Failed to Update", "ItemModal.ModifyFailed": "Failed to Update",
"ItemModal.Tabs": "Tab character", "ItemModal.Tabs": "Tab-character",
"ItemModal.NewLine": "Newline character", "ItemModal.NewLine": "Newline-character",
"ItemModal.Space": "Blank space", "ItemModal.Space": "Blank-space",
"ApolloNsPanel.LoadingHistoryError": "Failed to load change history", "ApolloNsPanel.LoadingHistoryError": "Failed to load change history",
"ApolloNsPanel.LoadingGrayscaleError": "Failed to load change history", "ApolloNsPanel.LoadingGrayscaleError": "Failed to load change history",
"ApolloNsPanel.Deleted": "Delete Successfully", "ApolloNsPanel.Deleted": "Delete Successfully",
......
...@@ -156,7 +156,9 @@ function controller($rootScope, $scope, $translate, toastr, AppUtil, EventManage ...@@ -156,7 +156,9 @@ function controller($rootScope, $scope, $translate, toastr, AppUtil, EventManage
return; return;
} }
$scope.config = item; $scope.config = {};
$scope.config.key = _.escape(item.key);
$scope.config.value = _.escape(item.value);
$scope.toOperationNamespace = namespace; $scope.toOperationNamespace = namespace;
toDeleteItemId = item.id; toDeleteItemId = item.id;
......
...@@ -144,7 +144,7 @@ function itemModalDirective($translate, toastr, $sce, AppUtil, EventManager, Con ...@@ -144,7 +144,7 @@ function itemModalDirective($translate, toastr, $sce, AppUtil, EventManager, Con
return; return;
} }
var hiddenCharCounter = 0, valueWithHiddenChars = value; var hiddenCharCounter = 0, valueWithHiddenChars = _.escape(value);
for (var i = 0; i < value.length; i++) { for (var i = 0; i < value.length; i++) {
var c = value[i]; var c = value[i];
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment