Merge pull request #1687 from brianvans/queues_view_xss

Escape id parameter for queues view
resque · Jul 22, 2021 · e8e2367 · e8e2367
2 parents 8b0bf00 + efe7ba1
commit e8e2367
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/resque/server/views/queues.erb b/lib/resque/server/views/queues.erb
@@ -2,7 +2,7 @@
 
 <% if current_queue = params[:id] %>
 
-  <h1>Pending jobs on <span class='hl'><%= current_queue %></span></h1>
+  <h1>Pending jobs on <span class='hl'><%= h current_queue %></span></h1>
   <form method="POST" action="<%=u "/queues/#{current_queue}/remove" %>" class='remove-queue'>
     <input type='submit' name='' value='Remove Queue' onclick='return confirm("Are you absolutely sure? This cannot be undone.");' />
   </form>