TryGhost/Ghost
1
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2024-12-25 11:55:03 +03:00
Code Issues Projects Releases Wiki Activity

🐛Fixed XSS vulnerability involving post excerpts (#17190)

Browse Source 
closes https://github.com/TryGhost/Ghost/issues/17058

- Uses the lodash `escape` function.
- Avoids XSS vulnerabilities in post excerpts.
This commit is contained in:
Joel DeSante 2023-12-13 21:23:48 +00:00 committed by GitHub
parent b2a429437e
commit dc7e2b9261
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ghost/core/core/frontend/helpers/excerpt.js
View File

@ -22,6 +22,8 @@ module.exports = function excerpt(options) {
} else { } else {
excerptText = ''; excerptText = '';
} }
excerptText = _.escape(excerptText);
truncateOptions = _.reduce(truncateOptions, (_truncateOptions, value, key) => { truncateOptions = _.reduce(truncateOptions, (_truncateOptions, value, key) => {
if (['words', 'characters'].includes(key)) { if (['words', 'characters'].includes(key)) {