Skip to content

Fix XSS via unsanitized user input in Absolute Time Range validation tooltips#2910

Merged
deniszh merged 2 commits intomasterfrom
copilot/fix-issue-2746
Mar 17, 2026
Merged

Fix XSS via unsanitized user input in Absolute Time Range validation tooltips#2910
deniszh merged 2 commits intomasterfrom
copilot/fix-issue-2746

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 17, 2026

ExtJS renders form field validation errors as HTML in QuickTip tooltips. The DateField and TimeField defaults embed the raw user value via {0} in invalidText (e.g. "{0} is not a valid date"), which flows directly into innerHTML on hover — allowing arbitrary script execution via inputs like <img src=1 onerror=alert()>.

Change

Override invalidText on all four fields in selectAbsoluteTime() with static strings containing no user-input placeholder:

var startDateField = new Ext.form.DateField({
  fieldLabel: 'Start Date',
  width: 125,
  value: TimeRange.startDate || '',
  invalidText: 'Not a valid date'   // was: "{0} is not a valid date - it must be in the format {1}"
});

Same applied to startTimeField, endDateField, and endTimeField.


📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

…on tooltips

Co-authored-by: deniszh <1227222+deniszh@users.noreply.github.com>
@deniszh deniszh marked this pull request as ready for review March 17, 2026 22:29
Copilot AI changed the title [WIP] [GH-2746] Check and fix issue with graphite-web Fix XSS via unsanitized user input in Absolute Time Range validation tooltips Mar 17, 2026
Copilot AI requested a review from deniszh March 17, 2026 22:30
@deniszh deniszh merged commit 2dcbb33 into master Mar 17, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants