-
Notifications
You must be signed in to change notification settings - Fork 783
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
HTML Reporter: Fix an unescaped details.source. #1341
HTML Reporter: Fix an unescaped details.source. #1341
Conversation
Fix an unescaped details.source in innerHTML. It became apparent when using .xhtml (application/xml+xhtml) but may have other XSS issues (see https://en.wikipedia.org/wiki/Cross-site_scripting ) in plain HTML. The new test gets stuck before the production code fix and completes successfully and promptly after applying it.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, thanks for contributing!
I'd like another set of eyes on this before merging.
@Krinkle @trentmwillis Are the test failures related to the changes in this PR? At a quick glance, I'm not sure they are, but maybe I'm missing something. |
They're unrelated, and have been fixed since the PR started. I'll close and re-open this PR so that GitHub creates a new merge commit and let Travis test that. |
My bad. The fix for that failure is still pending at #1339. I'll get that sorted now. |
Merged #1339, restarting Travis... |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks!
On Thu, 20 Dec 2018 20:09:55 -0800 Trent Willis ***@***.***> wrote:
Merged #1341 into master.
fantastic! Thanks all!
…--
-----------------------------------------------------------------
Shlomi Fish http://www.shlomifish.org/
http://www.shlomifish.org/humour/bits/Can-I-SCO-Now/ - “Can I SCO Now?”
“A is A, and A is not not-A? WTH is he talking about??! Of course A can be
not-A! I want a little of the stuff he’s on!”
— Initial reaction to the http://en.wikipedia.org/wiki/Organon
Please reply to list if it's a mailing list post - http://shlom.in/reply .
|
See qunitjs/qunit#1341 . The xhtml was invalid.
Fix an unescaped details.source in innerHTML.
It became apparent when using .xhtml (application/xml+xhtml) but may
have other XSS issues (see
https://en.wikipedia.org/wiki/Cross-site_scripting ) in plain HTML.
The new test gets stuck before the production code fix and completes
successfully and promptly after applying it.