No OneTemporary
Actions

Authored By

Unknown

Size

1 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/changelog.d/3901.security b/changelog.d/3901.security
	new file mode 100644
	index 000000000..a3d8bd01f
	--- /dev/null
	+++ b/changelog.d/3901.security
	@@ -0,0 +1 @@
	+Preload: Make generated JSON html-safe. It already was html safe because it only consists of config data that is base64 encoded, but this will keep it safe it that ever changes.
	diff --git a/lib/pleroma/web/preload.ex b/lib/pleroma/web/preload.ex
	index 4485383f9..6a4a8885e 100644
	--- a/lib/pleroma/web/preload.ex
	+++ b/lib/pleroma/web/preload.ex
	@@ -1,35 +1,35 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Preload do
	alias Phoenix.HTML

	def build_tags(_conn, params) do
	preload_data =
	Enum.reduce(Pleroma.Config.get([__MODULE__, :providers], []), %{}, fn parser, acc ->
	terms =
	params
	\|> parser.generate_terms()
	- \|> Enum.map(fn {k, v} -> {k, Base.encode64(Jason.encode!(v))} end)
	+ \|> Enum.map(fn {k, v} -> {k, Base.encode64(Jason.encode!(v, escape: :html_safe))} end)
	\|> Enum.into(%{})

	Map.merge(acc, terms)
	end)

	rendered_html =
	preload_data
	- \|> Jason.encode!()
	+ \|> Jason.encode!(escape: :html_safe)
	\|> build_script_tag()
	\|> HTML.safe_to_string()

	rendered_html
	end

	def build_script_tag(content) do
	HTML.Tag.content_tag(:script, HTML.raw(content),
	id: "initial-results",
	type: "application/json"
	)
	end
	end