Bug 36385 - HTML escaped via JavaScript should encode all entities
Summary: HTML escaped via JavaScript should encode all entities
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on: 36382
Blocks:
  Show dependency treegraph
 
Reported: 2024-03-21 13:47 UTC by Kyle M Hall
Modified: 2024-04-02 00:24 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall 2024-03-21 13:47:33 UTC
In staff-global.js, we have a function escape_str. This function only encodes a tiny subset of html characters. We should use https://github.com/mathiasbynens/he to encode the full set of html entities.
Comment 1 David Cook 2024-04-02 00:24:09 UTC
(In reply to Kyle M Hall from comment #0)
> In staff-global.js, we have a function escape_str. This function only
> encodes a tiny subset of html characters. We should use
> https://github.com/mathiasbynens/he to encode the full set of html entities.

In theory, escape_str might work as a "HtmlAttributeEncode" method if it were to include double quotes, single quotes, ampersands, and angle brackets. 

But I think we're trying to use it in context where a full HTML entity encode is needed. 

Overall, I think we should be writing better Javascript, but adding layers of protection is useful I think.