From f9c661ef5d2a422f246b3a089bee06470ae1d431 Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Sun, 07 Sep 2014 12:04:12 -0400
Subject: [PATCH] Merged #164 "Sanitize page parameters for XSS vulerabilities"
---
src/main/java/com/gitblit/wicket/pages/RepositoryPage.java | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/src/main/java/com/gitblit/wicket/pages/RepositoryPage.java b/src/main/java/com/gitblit/wicket/pages/RepositoryPage.java
index 253c4fe..2bd9dc6 100644
--- a/src/main/java/com/gitblit/wicket/pages/RepositoryPage.java
+++ b/src/main/java/com/gitblit/wicket/pages/RepositoryPage.java
@@ -550,7 +550,8 @@
String html;
switch (model.commitMessageRenderer) {
case MARKDOWN:
- html = MessageFormat.format("<div class='commit_message'>{0}</div>", content);
+ String safeContent = app().xssFilter().relaxed(content);
+ html = MessageFormat.format("<div class='commit_message'>{0}</div>", safeContent);
break;
default:
html = MessageFormat.format("<pre class='commit_message'>{0}</pre>", content);
--
Gitblit v1.9.1