Reviewed: https://review.openstack.org/169462 Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=2ad1e1935a325cc5345fb4b08ca7ecdf3a8dadf7 Submitter: Jenkins Branch: master commit 2ad1e1935a325cc5345fb4b08ca7ecdf3a8dadf7 Author: Paul McMillan <paul.mcmillan at nebula.com> Date: Tue Mar 31 20:07:26 2015 +0100 Fix unlikely XSS in attachment rendering This isn't likely to get hit in production, but it's generally a good cleanup. Change-Id: I9f92098046038bf1ab2afdd17c845ef44f89af3b Closes-Bug: 1260525 ** Changed in: horizon Status: In Progress => Fix Committed -- You received this bug notification because you are a member of OpenStack Security Group, which is subscribed to OpenStack. https://bugs.launchpad.net/bugs/1260525 Title: Incomplete XSS fix for ossa/1247675 Status in OpenStack Dashboard (Horizon): Fix Committed Status in OpenStack Security Advisories: Invalid Bug description: The patch for https://bugs.launchpad.net/ossa/+bug/1247675 did not completely fix the reported issue. It failed to completely remove the use of html.strip_tags, which is not intended to be a security function, and does not properly sanitize output. https://github.com/openstack/horizon/blob/master/openstack_dashboard/dashboards/project/volumes/tables.py#L254 To manage notifications about this bug go to: https://bugs.launchpad.net/horizon/+bug/1260525/+subscriptions