Updating production: new concordances #479
Conversation
…e public view, without "approved"
…eletion for old format + template updates + styling
Feature/new concordances tc fixes
… feature/new-concordances
Feature/new concordances
Feature/new concordances updates
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ) | ||
|
|
||
| options = empty_option + part_options | ||
| return HttpResponse(options) |
Check warning
Code scanning / CodeQL
Reflected server-side cross-site scripting Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the reflected server-side cross-site scripting vulnerability, we need to escape the user-provided input before including it in the HTML response. In Django, we can use the django.utils.html.escape function to properly escape any HTML special characters in the user input.
Steps to fix:
- Import the
escapefunction fromdjango.utils.html. - Use the
escapefunction to sanitize thepart.valuebefore including it in the HTML options.
| @@ -1,2 +1,3 @@ | ||
| from django.contrib.auth.mixins import LoginRequiredMixin, PermissionRequiredMixin | ||
| from django.utils.html import escape | ||
| from django.db import DatabaseError | ||
| @@ -49,3 +50,3 @@ | ||
| [ | ||
| f'<option value="{part.id}">{part.value}</option>' | ||
| f'<option value="{part.id}">{escape(part.value)}</option>' | ||
| for part in parts |
| @@ -123,6 +123,8 @@ | |||
|
|
|||
| <script src="{%static 'js/ckeditor/ckeditor.js'%}"></script> | |||
|
|
|||
| <script src="https://cdnjs.cloudflare.com/ajax/libs/fuse.js/6.4.6/fuse.min.js"></script> | |||
Check warning
Code scanning / CodeQL
Inclusion of functionality from an untrusted source Medium
No issues reported from research team so will merge into production