fix(security): treat messages as text, not HTML (#38062)

2020-01-13 10:56:29 +01:00
parent 978bae6716
commit bb5a9e8153
1 changed files with 1 additions and 1 deletions
--- a/client/src/components/Flash/index.js
+++ b/client/src/components/Flash/index.js
@ -11,7 +11,7 @@ function Flash({ flashMessage, onClose }) {
    <TransitionGroup>
      <CSSTransition classNames='flash-message' key={id} timeout={500}>
        <Alert bsStyle={type} className='flash-message' onDismiss={onClose}>
-          <div dangerouslySetInnerHTML={{ __html: message }} />
+          {message}
        </Alert>
      </CSSTransition>
    </TransitionGroup>