From d64a646c0a9c4ea1ca7f6213e4d353132cb735c1 Mon Sep 17 00:00:00 2001 From: zeripath Date: Fri, 10 May 2019 18:48:28 +0100 Subject: [PATCH] Escape the commit message on issues update and title in telegram hook (#6901) --- models/action.go | 3 ++- models/webhook_telegram.go | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/models/action.go b/models/action.go index 01a6a91704..f397298699 100644 --- a/models/action.go +++ b/models/action.go @@ -8,6 +8,7 @@ package models import ( "encoding/json" "fmt" + "html" "path" "regexp" "strconv" @@ -580,7 +581,7 @@ func UpdateIssuesCommit(doer *User, repo *Repository, commits []*PushCommit, bra } refMarked[issue.ID] = true - message := fmt.Sprintf(`%s`, repo.Link(), c.Sha1, c.Message) + message := fmt.Sprintf(`%s`, repo.Link(), c.Sha1, html.EscapeString(c.Message)) if err = CreateRefComment(doer, refRepo, issue, message, c.Sha1); err != nil { return err } diff --git a/models/webhook_telegram.go b/models/webhook_telegram.go index 9aef0e3ece..7976d14c57 100644 --- a/models/webhook_telegram.go +++ b/models/webhook_telegram.go @@ -7,6 +7,7 @@ package models import ( "encoding/json" "fmt" + "html" "strings" "code.gitea.io/gitea/modules/git" @@ -169,7 +170,7 @@ func getTelegramIssuesPayload(p *api.IssuePayload) (*TelegramPayload, error) { func getTelegramIssueCommentPayload(p *api.IssueCommentPayload) (*TelegramPayload, error) { url := fmt.Sprintf("%s/issues/%d#%s", p.Repository.HTMLURL, p.Issue.Index, CommentHashTag(p.Comment.ID)) - title := fmt.Sprintf(`#%d %s`, url, p.Issue.Index, p.Issue.Title) + title := fmt.Sprintf(`#%d %s`, url, p.Issue.Index, html.EscapeString(p.Issue.Title)) var text string switch p.Action { case api.HookIssueCommentCreated: