security: fix XSS for malicioius URLs #114

McShelby · Oct 8, 2021 · 2117fef · 2117fef
1 parent 7888239
commit 2117fef
Showing 1 changed file with 2 additions and 4 deletions.
diff --git a/static/js/relearn.js b/static/js/relearn.js
@@ -510,10 +510,8 @@ jQuery(function() {
         var element = $(this);
         var url = encodeURI(document.location.origin + document.location.pathname);
         var link = url + "#"+element[0].id;
-        return " <span class='anchor' data-clipboard-text='"+link+"'>" +
-            "<i class='fas fa-link fa-lg'></i>" +
-            "</span>"
-        ;
+        var html = " " + $( "<span>" ).addClass("anchor").attr("data-clipboard-text", link).append("<i class='fas fa-link fa-lg'></i>").get(0).outerHTML;
+        return html;
     });
 
     $(".anchor").on('mouseleave', function(e) {