Sanitize: do not escape forward slash (#65416)
This commit is contained in:
@@ -85,6 +85,5 @@ export function escapeHtml(str: string): string {
|
||||
.replace(/</g, '<')
|
||||
.replace(/>/g, '>')
|
||||
.replace(/'/g, ''')
|
||||
.replace(/\//g, '/')
|
||||
.replace(/"/g, '"');
|
||||
}
|
||||
|
||||
@@ -420,7 +420,7 @@ describe('templateSrv', () => {
|
||||
{ type: 'query', name: 'test', current: { value: '<script>alert(asd)</script>' } },
|
||||
]);
|
||||
const target = _templateSrv.replace('$test', {}, 'html');
|
||||
expect(target).toBe('<script>alert(asd)</script>');
|
||||
expect(target).toBe('<script>alert(asd)</script>');
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
Reference in New Issue
Block a user