Merge pull request #3140 from evazion/fix-reltags-xss

Fix #3139: XSS in Related Tags javascript.
2017-06-12 14:41:34 -07:00
parent 04ef575704 5f9fce7343
commit e26a974578
1 changed files with 2 additions and 6 deletions
--- a/app/assets/javascripts/related_tag.js
+++ b/app/assets/javascripts/related_tag.js
@@ -227,14 +227,10 @@
        if (text.match(/^ http/)) {
          text = text.substring(1, 1000);
          var $url = $("<a/>");
-          $url.text("open");
+          $url.text(text);
          $url.attr("href", text);
          $url.attr("target", "_blank");
-          var $li = $("<li/>");
-          $li.append(text + " [");
-          $li.append($url);
-          $li.append("]");
-          $ul.append($li);
+          $ul.append($("<li/>").html($url));
        } else {
          $ul.append($("<li/>").text(text));
        }