Leo Hemsted 5bbbdc3cd9 fix xss with service letter contact blocks ...

service contact blocks contain new lines - and jinja2 normally ignores
newlines (as in it keeps them as new lines) - but we need to turn them
into `<br>` tags so that we can show the formatting that the user has
added. We were previously just doing `{{ block | nl2br | safe }}`. nl2br
turns the new lines into `<br>` tags, and then `safe` tells jinja that
it doesn't need to escape the html.

this causes issues if the user adds `<script>alert(1)</script>` to their
contact block (or some other evil xss hack), where that will get let
through due to the safe flag

To solve this, use `Markup(html='escape')` to sanitise any html, and
then convert new lines to <br>.

bump utils

another xss

2020-01-21 17:34:49 +00:00

..

views

Merge pull request #3267 from alphagov/bank-hols

2020-01-21 10:24:02 +00:00

__init__.py

New pages to show a summary of all the reports the services has for its returned letters

2019-12-24 08:44:56 +00:00

_blacklisted_passwords.py

…

forms.py

Add a form to set priority of top 2 providers

2019-12-11 10:17:45 +00:00

validators.py

fix xss with service letter contact blocks

2020-01-21 17:34:49 +00:00