Merge pull request #1 from brun0ne/test-xss

different fix which does not break any tests
gchq · Apr 7, 2023 · 6b01cf0 · 6b01cf0
2 parents e9ff870 + 30f9286
commit 6b01cf0
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/web/waiters/RecipeWaiter.mjs b/src/web/waiters/RecipeWaiter.mjs
@@ -396,7 +396,11 @@ class RecipeWaiter {
         const item = document.createElement("li");
 
         item.classList.add("operation");
-        item.innerHTML = name.replace(">", "&gt;", "g").replace("<", "&lt;", "g");
+
+        if (this.app.operations[name] != null) {
+            item.innerHTML = name;
+        }
+
         this.buildRecipeOperation(item);
         document.getElementById("rec-list").appendChild(item);