From b76107bb240c54ba4d4c8e1d2badd412e5c473fa Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Tue, 04 Nov 2014 17:23:50 -0500
Subject: [PATCH] Whitelist the "target" link attribute in the XSS filter
---
src/main/java/com/gitblit/tickets/TicketIndexer.java | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/main/java/com/gitblit/tickets/TicketIndexer.java b/src/main/java/com/gitblit/tickets/TicketIndexer.java
index 98fe697..11ea3a7 100644
--- a/src/main/java/com/gitblit/tickets/TicketIndexer.java
+++ b/src/main/java/com/gitblit/tickets/TicketIndexer.java
@@ -143,8 +143,10 @@
private String escape(String value) {
if (value.charAt(0) != '"') {
- if (value.indexOf('/') > -1 || value.indexOf('-') > -1) {
- return "\"" + value + "\"";
+ for (char c : value.toCharArray()) {
+ if (!Character.isLetterOrDigit(c)) {
+ return "\"" + value + "\"";
+ }
}
}
return value;
--
Gitblit v1.9.1