prevent template injection

2016-05-23 11:02:47 +02:00 · 2016-05-23 11:02:47 +02:00 · 2c03ca70c2
parent f9490829af
commit 2c03ca70c2
1 changed files with 5 additions and 1 deletions
--- a/app/modules/user-timeline/user-timeline-item/user-timeline-item-title.service.coffee
+++ b/app/modules/user-timeline/user-timeline-item/user-timeline-item-title.service.coffee
@ -130,10 +130,14 @@ class UserTimelineItemTitle
    _getLink: (url, text, title) ->
        title = title || text

+        span = $('<span>')
+            .attr('ng-non-bindable', true)
+            .text(text)
+
        return $('<a>')
            .attr('tg-nav', url)
-            .text(text)
            .attr('title', title)
+            .append(span)
            .prop('outerHTML')

    _getUsernameSpan: (text) ->