mc-in-work/PrismLauncher
1
0
Fork 0
mirror of https://github.com/PrismLauncher/PrismLauncher.git synced 2026-07-02 19:36:57 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Technic: Prevent potential HTML injection

Browse source
This commit is contained in:
Jamie Mansfield 2021-12-24 15:20:34 +00:00
parent d44fa416ca
commit f267375ac2
No known key found for this signature in database
GPG key ID: 36F61598F39F67B0
1 changed files with 4 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

10
launcher/ui/pages/modplatform/technic/TechnicPage.cpp
View file

@ -202,14 +202,12 @@ void TechnicPage::metadataLoaded()
QString name = current.name;
if (current.websiteUrl.isEmpty())
// This allows injecting HTML here.
text = name;
text = name.toHtmlEscaped();
else
// URL not properly escaped for inclusion in HTML. The name allows for injecting HTML.
text = "<a href=\"" + current.websiteUrl + "\">" + name + "</a>";
text = "<a href=\"" + current.websiteUrl.toHtmlEscaped() + "\">" + name.toHtmlEscaped() + "</a>";
if (!current.author.isEmpty()) {
// This allows injecting HTML here
text += tr(" by ") + current.author;
text += tr(" by ") + current.author.toHtmlEscaped();
}
ui->frame->setModText(text);