Skip to content

Commit

Permalink
CVE-2021-3853: Fix HTML escaping in recipient_row.
Browse files Browse the repository at this point in the history 
Commit 44f9356 (#20462) incorrectly
added these extra braces while intending to add whitespace control.
This triple-brace syntax was asking Handlebars to skip escaping the
string.

Signed-off-by: Anders Kaseorg <anders@zulip.com>
  • Loading branch information
@andersk @alexmv
andersk authored and alexmv committed Jan 19, 2022
1 parent 3659d95 commit 3eb2791
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion static/templates/recipient_row.hbs
View file
Expand Up @@ -17,7 +17,7 @@
{{/if}}

{{~! Recipient (e.g. stream/topic or topic) ~}}
{{~{display_recipient}~}}
{{~display_recipient~}}
</a>

{{! hidden narrow icon for copy-pasting }}
Expand Down

1 comment on commit 3eb2791

@alexmv
Copy link
Collaborator

@alexmv alexmv commented on 3eb2791 Jan 27, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CVE-2021-3866 is the correct CVE for this commit; the CVE identifier we were originally given by a third-party was also assigned to an unrelated vulnerability in a different project.

Please sign in to comment.