New issue
Advanced search Search tips

Issue 768098 link

Starred by 1 user
Status: Available
Owner: ----
Cc:
hinoka@chromium.org
efoo@chromium.org
no...@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

Consistently use html/template instead of fmt.Sprintf in Milo console

Project Member Reported by vadimsh@chromium.org, Sep 23 2017 
From samueltan@:

(Fix) ad-hoc generation of HTML via the renderHTML methods in //infra/go/src/go.chromium.org/luci/milo/api/resp/console.go. There are a bunch of unvalidated URLs (see [1] and [2]) being interpolated into "href" attributes using format strings. It's hard for me to reason about where these URLs are coming from, what values they can possible assume. It would be much better to produce this entire HTML snippet using another html/template Template.


[1] https://cs.chromium.org/chromium/infra/go/src/go.chromium.org/luci/milo/api/resp/console.go?l=154&rcl=7ad046489c578e339b873886d6973abbe43cc137

[2] https://cs.chromium.org/chromium/infra/go/src/go.chromium.org/luci/milo/api/resp/console.go?l=268&rcl=7ad046489c578e339b873886d6973abbe43cc137

Comment 1 by s...@google.com, Sep 23 2017

Status: Available (was: Untriaged)
Should use safehtml/template, but otherwise yes.
Project Member

Comment 2 by sheriffbot@chromium.org, Sep 24

Labels: Hotlist-Recharge-Cold
Status: Untriaged (was: Available)
This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 3 by jchin...@chromium.org, Sep 24

Status: Available (was: Untriaged)
►

Sign in to add a comment