Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

singlepage.html: validation messages need to be HTML-escaped #164

Open
vaitkus opened this issue Jun 12, 2024 · 0 comments
Open

singlepage.html: validation messages need to be HTML-escaped #164

vaitkus opened this issue Jun 12, 2024 · 0 comments

Comments

@vaitkus
Copy link
Contributor

vaitkus commented Jun 12, 2024

Validation messages output in the webpages of individual developers are currently not properly escaped, most likely to accommodate replacement of \n with <br />:

{% for message in index_metadb.subdb_validation[subdb.attributes.base_url]['failure_messages'] %}
{% set bad_url = message[0].split(" - ")[0] %}
<a href="{{ bad_url }}">{{ bad_url | safe }}</a><br /><br />
<p>{{ message[1].replace("\n", "<br />") | safe }}</p><br />
{% endfor %}

As a result, symbols like "<" are not escaped (for example in the ResponseError: Request to 'structures?filter=nperiodic_dimensions < 3' returned HTTP status code 500. message).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant