phase1の機能実装 [feat/#43] #45

yoneyan · 2024-09-15T08:09:08Z

対象のIssue番号

fixes #43

変更内容

差分確認用

変更理由

なにか

dsbd/templates/base2.html

+  <link rel="stylesheet"
+        href="https://cdn.jsdelivr.net/npm/flatpickr/dist/flatpickr.min.css">
+  <!-- jquery -->
+  <script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>


dsbd/templates/custom_admin/ticket/chat.html

dsbd/templates/ticket/chat.html

custom_auth/views.py

dsbd/templates/custom_admin/ticket/chat.html

+          html += '<div class="message my-message">' + message + '</div>';
+        }
+        html += '</li>';
+        element.insertAdjacentHTML('beforebegin', html);


To fix the issue, all user-provided data (e.g., data.username and data.time) must be sanitized before being inserted into the DOM. The escapeHTML function already exists in the code and can be reused to sanitize these fields. This ensures that any potentially malicious content is properly escaped, preventing XSS attacks.

The changes involve:

Applying the escapeHTML function to data.username and data.time before interpolating them into the html string.

Ensuring that all dynamic content in the HTML string is sanitized.

dsbd/templates/ticket/chat.html

+          html += '<div class="message my-message">' + message + '</div>';
+        }
+        html += '</li>';
+        element.insertAdjacentHTML('beforebegin', html);


To fix the issue, all user-provided data used in constructing the HTML string must be sanitized to prevent XSS. The escapeHTML function should be applied to all fields that are interpolated into the HTML, including data.time, data.username, and data.is_admin. Additionally, the use of insertAdjacentHTML should be replaced with safer alternatives, such as creating DOM elements programmatically and appending them to the DOM.

yoneyan added 21 commits September 7, 2024 19:57

#43 通知ページの修正.

6edbbd0

#43 コード整形.

0975a7f

#43 サイドバーのボタン位置調整.

b7ac2b4

#43 掲載終了の通知情報を削除するスクリプト.

c07319d

#43 django signalsが実行出来ない問題の修正.

18816f1

#43 READMEの更新.

f8340bf

#43 ideaファイルの更新.

8e39145

#43 グループに関する情報をトップページに表示など.

6534b17

#43 pre-commit機能の追加.

a9df51a

#43 リファクタリング

5c4a5f5

#43 開発用の環境を整備 for web.

5a3c913

#43 ライブラリのアップデート for web.

66f50e7

#43 サービス情報と接続情報の登録機能の実装.

832fbad

#43 Webフォルダの削除(不要のため).

b1b5420

#43 routerやnoc modelの修正.

6e7c654

#43 ライブラリのアップデート.

c314df9

#43 軽微な修正.

cee3ec8

#43 チケットシステムの修正とメール送信機能の追加.

1cce464

#43 django-simple-historyを使った履歴を記録する仕組みを導入.

8f7986e

#43 DB情報更新時にSlack通知する機能の実装.

a091b14

#43 UserモードでSlack通知出来ない問題の修正.

d98bcad

task-automation-tool bot changed the title ~~phase1の完成~~ phase1の機能実装 [feat/#43] Sep 15, 2024

github-advanced-security bot found potential problems Sep 15, 2024

View reviewed changes

custom_auth/views.py Fixed Show fixed Hide fixed

yoneyan added 6 commits September 15, 2024 17:23

#43 通知機能の改修(登録時の処理).

8f8ba91

#43 リファクタリング.

fd4c913

#43 リファクタリング.

69f9199

#43 pipenv install忘れの修正.

3ec7eec

#43 Dockerfileの更新&workflowsファイルの修正.

29a723a

#43 管理者モード時にタグを表示機能の追加.

3afd2dc

yoneyan added 10 commits September 15, 2024 20:51

#43 リファクタリング.

d340ff2

#43 ライブラリのアップデート.

812a1a4

#43 会費支払いシステムの実装.

0e280e9

#43 文言の修正.

320f2f5

#43 donationシステムの実装.

f1982c3

#43 文字サイズの変更.

2aed855

#43 ライブラリのアップデート.

c3f1614

#43 ライブラリのアップデート.

4c8d41f

#43 pipライブラリのアップデート.

de6f31a

#43 pipライブラリのアップデート.

e3f9c67

github-advanced-security bot found potential problems May 6, 2025

View reviewed changes

yoneyan force-pushed the feat/#43 branch 2 times, most recently from 03d64d0 to ac4c519 Compare May 6, 2025 18:11

#43 ライブラリのアップデート・起動しない問題の修正.

636a292

yoneyan force-pushed the feat/#43 branch from ac4c519 to 636a292 Compare May 6, 2025 18:14

yoneyan added 13 commits June 21, 2025 17:18

ライブラリのアップデート.

678b977

static rootの修正.

385e50b

#43 dockerfileの修正.

35a38ed

#43 AUTH_LDAP_IS_ACTIVE_DNの追加.

7fa5b5b

#43 AUTH_LDAP_FIND_GROUP_PERMSを追加.

ede16ef

#43 debug configurationの追加.

b1b21a5

#43 settings.pyの修正.

061eb42

#43 EMAIL_USE_TLSを追加.

1b6372e

#43 軽微な修正.

6ffed09

#43 DBの修正とテキスト情報の追加.

ec117aa

#43 文言の追加とライブラリの追加.

ad7bd6f

#43 バリデーションの修正.

33d2782

#43 asgiの修正.

6c29e3f

@@ -379,3 +379,3 @@
                       html += '<div class="message-data text-end">';
-                      html += '<span class="message-data-time">(' + data.time + ')</span> '
+                      html += '<span class="message-data-time">(' + escapeHTML(data.time) + ')</span> '
                       if (data.is_admin) {
@@ -391,3 +391,3 @@
                       if (data.username !== '{{ request.user.username }}') {
-                        tmp_username = data.username;
+                        tmp_username = escapeHTML(data.username);
                       }
@@ -398,3 +398,3 @@
                       }
-                      html += '<span class="message-data-time">(' + data.time + ')</span>';
+                      html += '<span class="message-data-time">(' + escapeHTML(data.time) + ')</span>';
                       html += '</div>';

@@ -366,22 +366,44 @@
                     let message = escapeHTML(data.message).replace(/\n/g, '<br>');
+                    let time = escapeHTML(data.time);
+                    let username = escapeHTML(data.username);
+                    let li = document.createElement('li');
+                    li.className = 'clearfix';
-                    let html = '<li class="clearfix">';
                     if (data.username === '{{ request.user.username }}' && !data.is_admin) {
-                      html += '<div class="message-data text-end">';
-                      html += '<span class="message-data-time">(' + data.time + ')</span> あなた'
-                      html += '</div>';
-                      html += '<div class="message other-message float-right">' + message + '</div>'
+                      let messageData = document.createElement('div');
+                      messageData.className = 'message-data text-end';
+                      messageData.innerHTML = `<span class="message-data-time">(${time})</span> あなた`;
+                      li.appendChild(messageData);
+                      let messageDiv = document.createElement('div');
+                      messageDiv.className = 'message other-message float-right';
+                      messageDiv.innerHTML = message;
+                      li.appendChild(messageDiv);
                     } else {
-                      html += '<div class="message-data">';
+                      let messageData = document.createElement('div');
+                      messageData.className = 'message-data';
                       if (data.is_admin) {
-                        html += '<span class="badge bg-primary">管理者</span>';
+                        let adminBadge = document.createElement('span');
+                        adminBadge.className = 'badge bg-primary';
+                        adminBadge.textContent = '管理者';
+                        messageData.appendChild(adminBadge);
                       } else {
-                        html += data.username;
+                        messageData.textContent = username;
                       }
-                      html += '<span class="message-data-time">(' + data.time + ')</span>';
-                      html += '</div>';
-                      html += '<div class="message my-message">' + message + '</div>';
+                      let timeSpan = document.createElement('span');
+                      timeSpan.className = 'message-data-time';
+                      timeSpan.textContent = `(${time})`;
+                      messageData.appendChild(timeSpan);
+                      li.appendChild(messageData);
+                      let messageDiv = document.createElement('div');
+                      messageDiv.className = 'message my-message';
+                      messageDiv.innerHTML = message;
+                      li.appendChild(messageDiv);
                     }
-                    html += '</li>';
-                    element.insertAdjacentHTML('beforebegin', html);
+                    element.parentNode.insertBefore(li, element);
                   };

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

phase1の機能実装 [feat/#43] #45

phase1の機能実装 [feat/#43] #45

Uh oh!

yoneyan commented Sep 15, 2024 •

edited by task-automation-tool bot

Loading

Uh oh!

Check warning

Uh oh!

Uh oh!

Uh oh!

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

phase1の機能実装 [feat/#43] #45

Are you sure you want to change the base?

phase1の機能実装 [feat/#43] #45

Uh oh!

Conversation

yoneyan commented Sep 15, 2024 • edited by task-automation-tool bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

対象のIssue番号

変更内容

変更理由

Uh oh!

Check warning

Uh oh!

Uh oh!

Uh oh!

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

yoneyan commented Sep 15, 2024 •

edited by task-automation-tool bot

Loading