yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove clean xss from datatype name and alias. (#15552)

Browse Source 
* Remove clean xss from datatype name and alias.

* Edit / and \ to the exclusions argument

* Forgot to escape the backslash

---------

Co-authored-by: Lucas Bach Bisgaard <lom@novicell.dk>
This commit is contained in:
Lucas Bach Bisgaard
2024-02-10 01:50:03 +01:00
committed by GitHub
parent 7046c3585b
commit 9e5eb2da08
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Umbraco.Web.BackOffice/Filters/DataTypeValidateAttribute.cs
View File

@@ -45,7 +45,7 @@ internal sealed class DataTypeValidateAttribute : TypeFilterAttribute
var dataType = (DataTypeSave?)context.ActionArguments["dataType"];
if (dataType is not null)
{
dataType.Name = dataType.Name?.CleanForXss('[', ']', '(', ')', ':');
dataType.Name = dataType.Name?.CleanForXss('[', ']', '(', ')', ':', '/', '\\');
dataType.Alias = dataType.Alias == null
? dataType.Name!
: dataType.Alias.CleanForXss('[', ']', '(', ')', ':');