Fixed reflected XSS described in issue 1265

2025-12-23 19:53:26 +00:00 · 2021-10-29 17:59:02 +01:00
parent ae1b12c120
commit d2174725a9
3 changed files with 7 additions and 3 deletions
--- a/src/core/operations/ScatterChart.mjs
+++ b/src/core/operations/ScatterChart.mjs
@@ -87,7 +87,7 @@ class ScatterChart extends Operation {
        const recordDelimiter = Utils.charRep(args[0]),
            fieldDelimiter = Utils.charRep(args[1]),
            columnHeadingsAreIncluded = args[2],
-            fillColour = args[5],
+            fillColour = Utils.escapeHtml(args[5]),
            radius = args[6],
            colourInInput = args[7],
            dimension = 500;