Skip to content

fix(client): safer HTML generating#19422

Merged
nijel merged 1 commit into
WeblateOrg:mainfrom
nijel:html
May 8, 2026
Merged

fix(client): safer HTML generating#19422
nijel merged 1 commit into
WeblateOrg:mainfrom
nijel:html

Conversation

@nijel

@nijel nijel commented May 7, 2026

Copy link
Copy Markdown
Member
  • The URL should be sane and provided by Weblate, but add basic sanitization to make sure that we don't generate undesired links.
  • Construct HTML in a way that XSS is not possible.

@nijel nijel added this to the 2026.5 milestone May 7, 2026
@nijel nijel requested review from KarenKonou and Copilot May 7, 2026 14:04

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ff866c7be6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread weblate/static/js/urls.js Outdated

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@nijel nijel changed the title fix(client): validate returned URL before using it fix(client): safer HTML generating May 7, 2026
@argos-ci

argos-ci Bot commented May 7, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build Status Details Updated (UTC)
default (Inspect) ⚠️ Changes detected (Review) 20 changed May 7, 2026, 7:56 PM

@nijel nijel requested a review from Copilot May 7, 2026 18:15

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Comment thread weblate/static/editor/tools/search.js Outdated
Comment thread weblate/static/js/urls.js Outdated
- The URL should be sane and provided by Weblate, but add basic
  sanitization to make sure that we don't generate undesired links.
- Construct HTML in a way that XSS is not possible.
- Coverted the search preview from jQuery.
- Use CSS class for the results as there can be more of them.
@nijel nijel merged commit 8b0adf1 into WeblateOrg:main May 8, 2026
53 of 56 checks passed
@nijel nijel deleted the html branch May 8, 2026 04:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants