jellyfin/jellyfin-web
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin-web.git synced 2026-09-03 03:50:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix xss in listview

Browse Source
This commit is contained in:
Bill Thornton
2026-05-24 13:15:05 -04:00
parent ec519022e2
commit d28ec6f48b
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/components/listview/listview.js
+9 -6
View File
@@ -191,6 +191,11 @@ export function getListViewHtml(options) {
for (let i = 0, length = items.length; i < length; i++) {
const item = items[i];
const safeOverviewHtml = item.Overview ?
// eslint-disable-next-line sonarjs/disabled-auto-escaping
DOMPurify.sanitize(markdownIt({ html: true }).render(item.Overview)) :
'';
let html = '';
if (options.showIndex) {
@@ -416,11 +421,9 @@ export function getListViewHtml(options) {
html += '</div>';
}
if (enableOverview && item.Overview) {
// eslint-disable-next-line sonarjs/disabled-auto-escaping
const overview = DOMPurify.sanitize(markdownIt({ html: true }).render(item.Overview || ''));
if (enableOverview && safeOverviewHtml) {
html += '<div class="secondary listItem-overview listItemBodyText">';
html += '<bdi>' + overview + '</bdi>';
html += `<bdi>${safeOverviewHtml}</bdi>`;
html += '</div>';
}
@@ -482,9 +485,9 @@ export function getListViewHtml(options) {
if (enableContentWrapper) {
html += '</div>';
if (enableOverview && item.Overview) {
if (enableOverview && safeOverviewHtml) {
html += '<div class="listItem-bottomoverview secondary">';
html += '<bdi>' + item.Overview + '</bdi>';
html += `<bdi>${safeOverviewHtml}</bdi>`;
html += '</div>';
}
}