gian/cloudstack-mirror
1
0
Fork 0
mirror of https://github.com/apache/cloudstack synced 2026-09-04 16:34:34 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Escape HTML in username, VM display name and diagnostics output

Browse Source
This commit is contained in:
Pearl Dsilva 2026-07-03 09:56:36 -04:00 committed by Abhishek Kumar
parent 113ccb28e3
commit 3eb928bc72
6 changed files with 19 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ui/src/config/section/compute.js
View File

@ -18,6 +18,7 @@
import { shallowRef, defineAsyncComponent } from 'vue'
import store from '@/store'
import { isZoneCreated } from '@/utils/zone'
import { escapeHtml } from '@/utils/util'
export default {
name: 'compute',
@ -377,7 +378,7 @@ export default {
show: (record) => { return ['Stopped'].includes(record.state) && record.passwordenabled },
response: (result) => {
return {
message: result.virtualmachine && result.virtualmachine.password ? `The password of VM <b>${result.virtualmachine.displayname}</b> is <b>${result.virtualmachine.password}</b>` : null,
message: result.virtualmachine && result.virtualmachine.password ? `The password of VM <b>${escapeHtml(result.virtualmachine.displayname)}</b> is <b>${result.virtualmachine.password}</b>` : null,
copybuttontext: result.virtualmachine.password ? 'label.copy.password' : null,
copytext: result.virtualmachine.password ? result.virtualmachine.password : null
}

3
ui/src/config/section/infra/routers.js
View File

@ -17,6 +17,7 @@
import { shallowRef, defineAsyncComponent } from 'vue'
import store from '@/store'
import { escapeHtml } from '@/utils/util'
export default {
name: 'router',
@ -226,7 +227,7 @@ export default {
options: ['ping', 'ping6', 'traceroute', 'traceroute6', 'arping']
}
},
response: (result) => { return result && result.diagnostics ? `<strong>Output</strong>:<br/>${result.diagnostics.stdout}<br/><strong>Error</strong>: ${result.diagnostics.stderr}<br/><strong>Exit Code</strong>: ${result.diagnostics.exitcode}` : 'Invalid response' }
response: (result) => { return result && result.diagnostics ? `<strong>Output</strong>:<br/>${escapeHtml(result.diagnostics.stdout)}<br/><strong>Error</strong>: ${escapeHtml(result.diagnostics.stderr)}<br/><strong>Exit Code</strong>: ${result.diagnostics.exitcode}` : 'Invalid response' }
},
{
api: 'getDiagnosticsData',

3
ui/src/config/section/infra/systemVms.js
View File

@ -17,6 +17,7 @@
import { shallowRef, defineAsyncComponent } from 'vue'
import store from '@/store'
import { escapeHtml } from '@/utils/util'
export default {
name: 'systemvm',
@ -145,7 +146,7 @@ export default {
options: ['ping', 'traceroute', 'arping']
}
},
response: (result) => { return result && result.diagnostics ? `<strong>Output</strong>:<br/>${result.diagnostics.stdout}<br/><strong>Error</strong>: ${result.diagnostics.stderr}<br/><strong>Exit Code</strong>: ${result.diagnostics.exitcode}` : 'Invalid response' }
response: (result) => { return result && result.diagnostics ? `<strong>Output</strong>:<br/>${escapeHtml(result.diagnostics.stdout)}<br/><strong>Error</strong>: ${escapeHtml(result.diagnostics.stderr)}<br/><strong>Exit Code</strong>: ${result.diagnostics.exitcode}` : 'Invalid response' }
},
{
api: 'getDiagnosticsData',

3
ui/src/config/section/network.js
View File

@ -20,6 +20,7 @@ import store from '@/store'
import tungsten from '@/assets/icons/tungsten.svg?inline'
import { isAdmin } from '@/role'
import { isZoneCreated } from '@/utils/zone'
import { escapeHtml } from '@/utils/util'
export default {
name: 'network',
@ -681,7 +682,7 @@ export default {
show: (record) => { return ['Stopped'].includes(record.state) && record.passwordenabled },
response: (result) => {
return {
message: result.virtualmachine && result.virtualmachine.password ? `The password of VM <b>${result.virtualmachine.displayname}</b> is <b>${result.virtualmachine.password}</b>` : null,
message: result.virtualmachine && result.virtualmachine.password ? `The password of VM <b>${escapeHtml(result.virtualmachine.displayname)}</b> is <b>${result.virtualmachine.password}</b>` : null,
copybuttontext: result.virtualmachine.password ? 'label.copy.password' : null,
copytext: result.virtualmachine.password ? result.virtualmachine.password : null
}

3
ui/src/config/section/user.js
View File

@ -17,6 +17,7 @@
import { shallowRef, defineAsyncComponent } from 'vue'
import store from '@/store'
import { escapeHtml } from '@/utils/util'
export default {
name: 'accountuser',
@ -111,7 +112,7 @@ export default {
api: 'lockUser',
icon: 'LockOutlined',
label: 'label.action.lock.user',
message: (record) => ['message.lock.user', { user: record.username }],
message: (record) => ['message.lock.user', { user: escapeHtml(record.username) }],
successMessage: (record) => ['message.lock.user.success', { user: record.username }],
dataView: true,
popup: true,

9
ui/src/utils/util.js
View File

@ -64,6 +64,15 @@ export function removeLoadingAnimate (id = '', timeout = 1500) {
}, timeout)
}
export function escapeHtml (value) {
return String(value)
.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&#039;')
}
export function sanitizeReverse (value) {
return value
.replace(/&amp;/g, '&')