Skip to content

LINDAT/Fix dspace-customers 1083 R68: sanitize RefBox citation HTML - #1677

Merged
milanmajchrak merged 1 commit into
customer/lindatfrom
lindat/fe-r68-refbox-xss
Oct 28, 2026
Merged

LINDAT/Fix dspace-customers 1083 R68: sanitize RefBox citation HTML#1677
milanmajchrak merged 1 commit into
customer/lindatfrom
lindat/fe-r68-refbox-xss

Conversation

@milanmajchrak

@milanmajchrak milanmajchrak commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

References

  • Backport of dataquest-dev/dspace-angular PR 1662 (dtq-dev commit a5298dd)
  • dspace-customers issue 1083, finding R68
  • Backend part: lindat backport of dataquest-dev/DSpace PR 1534 (DSpace PR 1571)

Description

The RefBox citation goes through Angular's sanitizer again, so scripts and event handlers in it are stripped. Cherry-pick from dtq-dev.

Instructions for Reviewers

List of changes in this PR:

  • Commit a5298dd cherry-picked without conflicts. The diff is the same as in the source PR (same git patch-id).

How to test: clarin-ref-citation.component.spec.ts from the source PR.

AI Disclosure

  • No
  • Yes

Claude Code made the cherry-pick and wrote this description. A second agent compared the diff with the source PR line by line.

Checklist

  • My PR is created against the main branch of code (unless it is a backport or is fixing an issue specific to an older branch).
  • My PR is small in size (e.g. less than 1,000 lines of code, not including comments & specs/tests), or I have provided reasons as to why that's not possible.
  • My PR follows all coding best practices based on the Code Conventions Guide
  • My PR passes ESLint validation using npm run lint
  • My PR doesn't introduce circular dependencies (verified via npm run check-circ-deps)
  • My PR includes TypeDoc comments for all new (or modified) public methods and classes. It also includes TypeDoc for large or complex private methods.
  • My PR passes all specs/tests and includes new/updated specs or tests based on the Code Testing Guide.
  • My PR aligns with Accessibility guidelines if it makes changes to the user interface.
  • My PR uses i18n (internationalization) keys instead of hardcoded English text, to allow for translations.
  • My PR includes details on how to test it. I've provided clear instructions to reviewers on how to successfully test this fix or feature.
  • If my PR includes new libraries/dependencies (in package.json), I've made sure their licenses align with the DSpace BSD License based on the Licensing of Contributions documentation.
  • If my PR includes new features or configurations, I've provided basic technical documentation in the PR itself.
  • If my PR fixes an issue ticket, I've linked them together.

🤖 Generated with Claude Code

@milanmajchrak @claude
LINDAT/UFAL/Fix dspace-customers 1083 R68: sanitize RefBox citation H…
11dd39d 
…TML (1662)

The citation text came from the server and was rendered with
bypassSecurityTrustHtml, so markup in item metadata could run scripts.
It now goes through Angular's sanitizer, which keeps the <i> and <a>
formatting, strips scripts and event handlers, and makes javascript:
links inert.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit a5298dd)
@milanmajchrak
milanmajchrak merged commit 103df87 into customer/lindat Oct 28, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@milanmajchrak