mirror of https://github.com/lxndrblz/anatole.git
parent: e3467438 | patch | commit | ignore whitespace
google-labs-jules[bot]
yesterday 74dc02581ea1ce3e274754fddec0384fb287d64f 
fix: mitigate XSS vulnerability in sidebar description

Properly escape HTML entities in the site description before replacing newlines with `<br />` tags and piping it to `safeHTML`. This ensures any malicious HTML tags (e.g., `<script>`) provided by the user via the `description` parameter are properly sanitized, resolving the Cross-Site Scripting (XSS) vulnerability.

Co-authored-by: KarelZe <12801659+KarelZe@users.noreply.github.com>
1 files modified
2 ■■■■■ changed files
layouts/partials/sidebar.html 2 ●●●●● patch | view | raw | blame | history 
 layouts/partials/sidebar.html


@@ -24,7 +24,7 @@


        </div>


      {{ end }}


      <div class="sidebar__introduction-description">


        <p>{{ replace .Site.Params.description "\n" "<br />" | safeHTML }}</p>


        <p>{{ replace (htmlEscape .Site.Params.description) "\n" "<br />" | safeHTML }}</p>


      </div>


    </div>


    <ul class="sidebar__list">