Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zulip/web/templates/narrow_tooltip.hbs

3 lines
41 B
Handlebars
Raw Normal View History

CVE-2023-33186: Fix topic tooltip cross-site scripting vulnerability. Commit 903dbda79bd176702d3175a7c8a5450a64b6eccb (#25370) introduced a cross-site scripting vulnerability in the tooltips for the stream and topic in the recipient bar. An attacker who can send messages could maliciously craft a topic for the message, such that a victim who hovers the tooltip for that topic in their message feed triggers execution of JavaScript code controlled by the attacker. Signed-off-by: Anders Kaseorg <anders@zulip.com>
2023-05-25 01:51:16 +02:00
{{content}}
{{tooltip_hotkey_hints "S"}}