[MEDIUM] Fix XSS and missing noopener in ticket print/export (fixes #2929)#2930
[MEDIUM] Fix XSS and missing noopener in ticket print/export (fixes #2929)#2930namann5 wants to merge 1 commit into
Conversation
- Replaced DOM-based escapeHTML() with a pure string-replace approach that does not depend on innerHTML/textContent browser parsing - Added noopener,noreferrer to window.open() to prevent the opened print window from accessing window.opener
|
@namann5 is attempting to deploy a commit to the ritesh Team on Vercel. A member of the Team first needs to authorize it. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a7720b4c0c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| export function printTicket(ticket) { | ||
| if (!ticket) return; | ||
| const win = window.open('', '_blank'); | ||
| const win = window.open('', '_blank', 'noopener,noreferrer'); |
There was a problem hiding this comment.
When printTicket is used from the admin Print button, passing noopener,noreferrer makes window.open sever the opener relationship; MDN documents that noopener causes window.open to return null, and noreferrer implies noopener. That means win is falsy even when the tab opens, so the function returns before document.write(...) and the printable ticket content/print dialog never appears in browsers following this behavior.
Useful? React with 👍 / 👎.
1 participant
Summary
Fixes #2929 - Two XSS-related issues in ticket print/export.
Changes