From 4a2ee43e807b0d3fd55ed26f9d03c8e39ea6e486 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Thu, 12 Jan 2017 03:54:50 +0100 Subject: [PATCH] Fix #457 - escape JSON in INITIAL_STATE (this bug only ever allowed a user to xss themselves rather than anyone else) --- app/views/home/index.html.haml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/views/home/index.html.haml b/app/views/home/index.html.haml index 730249129..0147f4064 100644 --- a/app/views/home/index.html.haml +++ b/app/views/home/index.html.haml @@ -1,6 +1,6 @@ - content_for :header_tags do :javascript - window.INITIAL_STATE = #{render(file: 'home/initial_state', formats: :json)} + window.INITIAL_STATE = #{json_escape(render(file: 'home/initial_state', formats: :json))} = javascript_include_tag 'application'