fix: improper neutralization of user input in image wrapping code

2 years ago · 1d1639d46f
parent c5cd76e798
commit 1d1639d46f
1 changed files with 2 additions and 1 deletions
--- a/public/src/client/topic/images.js
+++ b/public/src/client/topic/images.js
@ -26,8 +26,9 @@ define('forum/topic/images', [], function () {
 			const srcExt = src.split('.').slice(1).pop();
 			const altFilename = alt.split('/').pop();
 			const altExt = altFilename.split('.').slice(1).pop();
+
 			imageEl.wrap('<a href="' + src + '" ' +
-				(!srcExt && altExt ? ' download="' + altFilename + '" ' : '') +
+				(!srcExt && altExt ? ' download="' + utils.escapeHTML(altFilename) + '" ' : '') +
 				' target="_blank" rel="noopener">');
 		}
 	};