RDoc で生成した HTML ドキュメントにおける XSS 脆弱性 (CVE-2013-0256)

[ruby-list:49181] [ANN] Ruby 1.9.3 patchlevel 385 (includes a security fix) #Ruby

diff --git darkfish.js darkfish.js index 4be722f..f26fd45 100644 --- darkfish.js +++ darkfish.js @@ -109,13 +109,15 @@ function hookSearch() { function highlightTarget( anchor ) { console.debug( "Highlighting target '%s'.", anchor ); - $("a[name=" + anchor + "]").each( function() { - if ( !$(this).parent().parent().hasClass('target-section') ) { - console.debug( "Wrapping the target-section" ); - $('div.method-detail').unwrap( 'div.target-section' ); - $(this).parent().wrap( '<div class="target-section"></div>' ); - } else { - console.debug( "Already wrapped." ); + $("a[name]").each( function() { + if ( $(this).attr("name") == anchor ) { + if ( !$(this).parent().parent().hasClass('target-section') ) { + console.debug( "Wrapping the target-section" ); + $('div.method-detail').unwrap( 'div.target-section' ); + $(this).parent().wrap( '<div class="target-section"></div>' ); + ...

Full article: http://www.ruby-lang.org/ja/news/2013/02/06/rdoc-xss-cve-...