Skip to content

snpdb: escape HTML in sample name and trio outputs, validate wiki field names#1520

Open
davmlaw wants to merge 1 commit intomasterfrom
security/xss-wiki-fixes
Open

snpdb: escape HTML in sample name and trio outputs, validate wiki field names#1520
davmlaw wants to merge 1 commit intomasterfrom
security/xss-wiki-fixes

Conversation

@davmlaw
Copy link
Copy Markdown
Contributor

@davmlaw davmlaw commented Apr 2, 2026

Summary

  • Escape sample.name when building HTML links in sample_gene_matrix (rendered via | safe in template)
  • Escape trio.mother_details, trio.father_details, and trio.proband in trio_short_description template tag before passing to mark_safe
  • Validate that unique_keyword is a real field on the Wiki subclass model in Wiki.get_or_create, rejecting unknown field names with a 403

Relates to SACGF/variantgrid_private#3821

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant