Bug 1163393: XSS in the new jQuery autocomplete code

r=dkl,a=glob

Bug 1163393: XSS in the new jQuery autocomplete code
7f3cc642 · Byron Jones · bd41649c · 7f3cc642
Commit 7f3cc642 authored May 12, 2015 by Byron Jones
Hide whitespace changes
Inline Side-by-side

Showing with 6 additions and 2 deletions

field.js js/field.js +6 -2

No files found.
--- a/js/field.js
+++ b/js/field.js
@@ -844,8 +844,12 @@ $(function() {
            };
        },
        formatResult: function(suggestion, currentValue) {
-            return suggestion.data.name === '' ?
-                suggestion.data.login : suggestion.data.name + ' (' + suggestion.data.login + ')';
+            return (suggestion.data.name === '' ?
+                suggestion.data.login : suggestion.data.name + ' (' + suggestion.data.login + ')')
+                .replace(/&/g, '&amp;')
+                .replace(/</g, '&lt;')
+                .replace(/>/g, '&gt;')
+                .replace(/"/g, '&quot;');
        },
        onSearchStart: function(params) {
            var that = $(this);