From ca7e67d808bea3e1ed0ddac162642cd0e570f949 Mon Sep 17 00:00:00 2001
From: Jana Cupova <root@localhost>
Date: Feb 07 2022 09:45:27 +0000
Subject: Escape builds, tasks and tags name


Fixes: https://pagure.io/koji/issue/3155

---

diff --git a/www/kojiweb/builds.chtml b/www/kojiweb/builds.chtml
index 50fb113..dee5e2f 100644
--- a/www/kojiweb/builds.chtml
+++ b/www/kojiweb/builds.chtml
@@ -122,7 +122,7 @@
       #for $build in $builds
         <tr class="$util.rowToggle($self)">
           <td>$build.build_id</td>
-          <td><a href="buildinfo?buildID=$build.build_id">$koji.buildLabel($build)</a></td>
+          <td><a href="buildinfo?buildID=$build.build_id">$util.escapeHTML($koji.buildLabel($build))</a></td>
           #if $tag
           <td><a href="taginfo?tagID=$build.tag_id">$util.escapeHTML($build.tag_name)</a></td>
           #end if
diff --git a/www/kojiweb/index.chtml b/www/kojiweb/index.chtml
index 9aab309..2f72a56 100644
--- a/www/kojiweb/index.chtml
+++ b/www/kojiweb/index.chtml
@@ -54,7 +54,7 @@
     <tr class="$util.rowToggle($self) $scratch">
       #set $state = $util.taskState($task.state)
       <td>$task.id</td>
-      <td><a href="taskinfo?taskID=$task.id" class="task$state" title="$state">$koji.taskLabel($task)</a></td>
+      <td><a href="taskinfo?taskID=$task.id" class="task$state" title="$state">$util.escapeHTML($koji.taskLabel($task))</a></td>
       #if not $user
       <td class="user-$task.owner_name">
         #if $task.owner_type == $koji.USERTYPES['HOST']
diff --git a/www/kojiweb/tags.chtml b/www/kojiweb/tags.chtml
index fe39118..4f91c62 100644
--- a/www/kojiweb/tags.chtml
+++ b/www/kojiweb/tags.chtml
@@ -35,7 +35,7 @@
       #for $tag in $tags
         <tr class="$util.rowToggle($self)">
           <td>$tag.id</td>
-          <td><a href="taginfo?tagID=$tag.id$util.passthrough($self, 'childID')">$tag.name</a></td>
+          <td><a href="taginfo?tagID=$tag.id$util.passthrough($self, 'childID')">$util.escapeHTML($tag.name)</a></td>
         </tr>
       #end for
     #else
diff --git a/www/kojiweb/tasks.chtml b/www/kojiweb/tasks.chtml
index 00833ba..098516b 100644
--- a/www/kojiweb/tasks.chtml
+++ b/www/kojiweb/tasks.chtml
@@ -152,7 +152,7 @@ All
           #set $taskState = $util.taskState($task.state)
           <td>$task.id</td>
           <td#if $treeDisplay then ' class="tree"' else ''#>
-            #if $treeDisplay then '&nbsp;' else ''#<a href="taskinfo?taskID=$task.id" class="task$taskState" title="$taskState">$koji.taskLabel($task)</a>
+            #if $treeDisplay then '&nbsp;' else ''#<a href="taskinfo?taskID=$task.id" class="task$taskState" title="$taskState">$util.escapeHTML($koji.taskLabel($task))</a>
             #if $treeDisplay
             $printChildren($task.id, $task.descendents)
             #end if