-
Notifications
You must be signed in to change notification settings - Fork 15
Open
Labels
backendRelating to the code which runs on the server and generates the siteRelating to the code which runs on the server and generates the sitebugUnexpected behaviour on client or server sideUnexpected behaviour on client or server side
Description
hacksoc.org/templates/base.html.jinja2
Line 28 in c83e30e
| <meta property="og:description" content="{{lede|trim}}"> |
i am pretty sure this should be {{lede|trim|e}}, to avoid a problem which can be observed here: https://www.hacksoc.org/news/2014-01-20-bytemark-sponsorship.html
but i strongly suspect there are similar problems lurking elsewhere, since as far as i can tell jinja's autoescape feature is not enabled
we should probably enable autoescape and see what breaks, and/or audit all current uses of jinja interpolation
LukeMoll
Metadata
Metadata
Assignees
Labels
backendRelating to the code which runs on the server and generates the siteRelating to the code which runs on the server and generates the sitebugUnexpected behaviour on client or server sideUnexpected behaviour on client or server side