fix: escape exception messages in mark_safe calls and fix SQL interpolation #103

New Issue

MrUnknownDE · 2026-04-05T16:21:42+02:00

MrUnknownDE commented

2026-04-05 16:21:42 +02:00

Originally created by @Aprazor on 3/23/2026

Multiple XSS and security fixes:

truncate_middle filter: escape first_part/second_part before mark_safe
CustomLinkColumn.render: escape exception in title attribute
render_widget dashboard tag: escape exception message
custom_links tag: escape exception and cl.name in both ungrouped
and grouped link error paths
core/views.py: use current_database() directly instead of f-string
interpolation of db_name into SQL
core/jobs.py: guard max(releases) against empty list

Signed-off-by: Aprazors Aprazors@gmail.com

*Originally created by @Aprazor on 3/23/2026* Multiple XSS and security fixes: 1. truncate_middle filter: escape first_part/second_part before mark_safe 2. CustomLinkColumn.render: escape exception in title attribute 3. render_widget dashboard tag: escape exception message 4. custom_links tag: escape exception and cl.name in both ungrouped and grouped link error paths 5. core/views.py: use current_database() directly instead of f-string interpolation of db_name into SQL 6. core/jobs.py: guard max(releases) against empty list Signed-off-by: Aprazors <Aprazors@gmail.com>

MrUnknownDE closed this issue

2026-04-05 16:21:42 +02:00

Sign in to join this conversation.

Branches Tags

main

21455-sql-indexes-audit

21357-register-model-actions

feature

20924-plugin-ui-components

21766-improve-test-coverage-for-sortable-table-columns

21157-export-template-public-models

21025-pre-render-config-contexts

21364-swagger

feature-ip-prefix-link

20911-dropdown-3

fix_module_substitution

21160-filterset

20911-dropdown-2

20044-elevation-stuck-lightmode

7604-filter-modifiers-v3

20660-script-load

19724-graphql

14884-script

19720-macaddress-interface-generic-relation

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/netbox#103