maverick/docbrown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fixed bug that allows XSS with the codepen embed. (#1578)

Browse source
This commit is contained in:
Dave Follett 2019-01-17 11:38:39 -05:00 • committed by Mac Siri
parent b8117775e3
commit 6c571e8bcd
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/liquid_tags/codepen_tag.rb
View file

@ -33,7 +33,7 @@ class CodepenTag < LiquidTagBase
validated_options = options.map { |o| valid_option(o) }.reject { |e| e == nil }
raise StandardError, "Invalid Options" unless options.empty? || !validated_options.empty?
option = options.join("&")
option = validated_options.join("&")
if option.blank?
"default-tab=result"