github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-07-24 08:34:04 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

Over-Escaped Wiki Page Title #1223

New Issue
Closed
opened 2025-11-02 03:52:56 -06:00 by GiteaMirror · 1 comment
GiteaMirror commented 2025-11-02 03:52:56 -06:00
Owner
Copy Link
Copy Source

Originally created by @mohammed90 on GitHub (Nov 7, 2017).

  • Gitea version (or commit ref): 61f5c22
  • Git version: 2.7.4
  • Operating system: Linux
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:
  • Log gist:

Description

The title of a Wiki page is over-escaped if it contains any special character. It's displayed properly on the main page of the Wiki, here.

Screenshots

gitea wiki overescaped
Originally created by @mohammed90 on GitHub (Nov 7, 2017). - Gitea version (or commit ref): 61f5c22 - Git version: 2.7.4 - Operating system: Linux - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes (provide example URL): [Link to page](https://try.gitea.io/nobody/wiki_over-escape_bug/wiki/Home-%26-Test) - [ ] No - [ ] Not relevant - Log gist: ## Description The title of a Wiki page is over-escaped if it contains any special character. It's displayed properly on the main page of the Wiki, [here](https://try.gitea.io/nobody/wiki_over-escape_bug/wiki/_pages). ## Screenshots <img width="470" alt="gitea wiki overescaped" src="https://user-images.githubusercontent.com/2636183/32508729-4d342050-c3fc-11e7-92e5-148de8fbe45e.png">
GiteaMirror added the type/bug label 2025-11-02 03:52:56 -06:00
GiteaMirror commented 2025-11-02 03:52:57 -06:00
Author
Owner
Copy Link
Copy Source

@makarchuk commented on GitHub (Nov 19, 2017):

Problem is Sanitatize call in this line.
It was added 9 month ago, but I don't see why. I removed it and still can't get XSS
screenshot from 2017-11-19 15-23-39

@makarchuk commented on GitHub (Nov 19, 2017): Problem is `Sanitatize` call in [this](https://github.com/go-gitea/gitea/blame/master/templates/repo/wiki/view.tmpl#L4) line. It was added 9 month ago, but I don't see why. I removed it and still can't get XSS ![screenshot from 2017-11-19 15-23-39](https://user-images.githubusercontent.com/13999738/32990621-b38fa690-cd3d-11e7-87fe-a6bef304aebc.png)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No labels type/bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#1223