Skip to content

fix: Prevent html injection in ProfileForm - #202

Open
ciurana-life wants to merge 1 commit into
inveniosoftware:masterfrom
ciurana-life:fix-security-html-injection
Open

fix: Prevent html injection in ProfileForm#202
ciurana-life wants to merge 1 commit into
inveniosoftware:masterfrom
ciurana-life:fix-security-html-injection

Conversation

@ciurana-life

Copy link
Copy Markdown

Description

  • Fix for #537
  • Blocks special characters in the browser for "full name" input
  • Blocks special characters with backend validation for "full name"

HTML pattern attribute explanation here.

Checklist

Ticks in all boxes and 🟢 on all GitHub actions status checks are required to merge:

Frontend

Reminder

By using GitHub, you have already agreed to the GitHub’s Terms of Service including that:

  1. You license your contribution under the same terms as the current repository’s license.
  2. You agree that you have the right to license your contribution under the current repository’s license.

@mairasalazar mairasalazar left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@slint slint left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, one minor thing about using the wtforms API differently for the validation

Comment thread invenio_userprofiles/forms.py Outdated
* Blocks special characters in the browser for "full name" input
* Blocks special characters with backend validation for "full name"

Signed-off-by: Victor Ciurana <victor.ciurana.loeffler@cern.ch>
@ciurana-life
ciurana-life force-pushed the fix-security-html-injection branch from eef7158 to 052c488 Compare August 31, 2026 09:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants