From 14abe07a4a8be90bbe763542a6e02fbb2aaf20d2 Mon Sep 17 00:00:00 2001 From: Ben Sturmfels Date: Fri, 17 Dec 2021 21:55:47 +1100 Subject: [PATCH] Remove unnecessary use of "safe" template tag. This tag marks a variable as not requiring escaping by the template engine, potentially creating cross-site scripting vulnerabilities, so shouldn't be used unless absolutely necessary. In these cases, I don't think it's necessary. --- www/conservancy/templates/blog/entry_detail.html | 2 +- www/conservancy/templates/blog/entry_partial.html | 2 +- www/conservancy/templates/feeds/blog_title.html | 2 +- www/conservancy/templates/feeds/news_description.html | 2 +- www/conservancy/templates/feeds/news_title.html | 2 +- www/conservancy/templates/frontpage.html | 2 +- www/conservancy/templates/news/pressrelease_detail.html | 2 +- www/conservancy/templates/news/pressrelease_partial.html | 4 ++-- www/conservancy/templates/opengraph_partial.html | 4 ++-- www/conservancy/templates/sponsors.html | 6 +++--- 10 files changed, 14 insertions(+), 14 deletions(-) diff --git a/www/conservancy/templates/blog/entry_detail.html b/www/conservancy/templates/blog/entry_detail.html index 87488a68..70bd722b 100644 --- a/www/conservancy/templates/blog/entry_detail.html +++ b/www/conservancy/templates/blog/entry_detail.html @@ -6,7 +6,7 @@ {% include "opengraph_urllist_partial.html" with property='video' urls=object.get_one_video_url %} {% endblock %} -{% block subtitle %}{{ object.headline|striptags|safe }} - Conservancy Blog - {% endblock %} +{% block subtitle %}{{ object.headline|striptags }} - Conservancy Blog - {% endblock %} {% block content %}
diff --git a/www/conservancy/templates/blog/entry_partial.html b/www/conservancy/templates/blog/entry_partial.html index 571d69f2..9ec8266f 100644 --- a/www/conservancy/templates/blog/entry_partial.html +++ b/www/conservancy/templates/blog/entry_partial.html @@ -18,7 +18,7 @@ This partial accepts these optional parameters: <{{ htag|default:"h3" }} class="clear" >{% if show|default:"body" != "body" %}{% endif %}{{ entry.headline|safe }}{% if show|default:"body" != "body" %}{% endif %} + >{% endif %}{{ entry.headline }}{% if show|default:"body" != "body" %}{% endif %} {% if show != "headline" %}

by {{ entry.author.formal_name }} diff --git a/www/conservancy/templates/feeds/blog_title.html b/www/conservancy/templates/feeds/blog_title.html index 41fedac7..d05ff107 100644 --- a/www/conservancy/templates/feeds/blog_title.html +++ b/www/conservancy/templates/feeds/blog_title.html @@ -1 +1 @@ -{{ obj.headline|striptags|safe }} +{{ obj.headline|striptags }} diff --git a/www/conservancy/templates/feeds/news_description.html b/www/conservancy/templates/feeds/news_description.html index 34c9a619..69751ba9 100644 --- a/www/conservancy/templates/feeds/news_description.html +++ b/www/conservancy/templates/feeds/news_description.html @@ -1,3 +1,3 @@ -{% if obj.subhead %}

{{ obj.subhead|safe }}

{% endif %} +{% if obj.subhead %}

{{ obj.subhead }}

{% endif %} {{ obj.summary|safe }} {{ obj.body|safe }} diff --git a/www/conservancy/templates/feeds/news_title.html b/www/conservancy/templates/feeds/news_title.html index 41fedac7..d05ff107 100644 --- a/www/conservancy/templates/feeds/news_title.html +++ b/www/conservancy/templates/feeds/news_title.html @@ -1 +1 @@ -{{ obj.headline|striptags|safe }} +{{ obj.headline|striptags }} diff --git a/www/conservancy/templates/frontpage.html b/www/conservancy/templates/frontpage.html index 7c2ce89d..f83ced33 100644 --- a/www/conservancy/templates/frontpage.html +++ b/www/conservancy/templates/frontpage.html @@ -104,7 +104,7 @@ strategies that defend FOSS (such as copyleft).