Merge lp:~wallyworld/launchpad/duplicate-bug-warning-xss-1057630 into lp:launchpad

[Ian Booth]

Remove xss from bug duplicate links.

Tweak the duplicate.js code to remove some XSS issues.

[William Grant (wgrant)]

review: Approve (code)

=== modified file 'lib/lp/bugs/javascript/duplicates.js'
--- lib/lp/bugs/javascript/duplicates.js	2012-09-21 02:51:51 +0000
+++ lib/lp/bugs/javascript/duplicates.js	2012-09-28 05:03:25 +0000
@@ -380,12 +380,13 @@
     // Create the informational message to go at the top of the bug tasks
     // table.
     _duplicate_bug_info_message: function(dup_id, dup_title) {
-        var info_template = [
+        return Y.lp.mustache.to_html([
             '<span class="bug-duplicate-details ellipsis ',
             'single-line wide">',
             '<span class="sprite info"></span>',
             'This bug report is a duplicate of:&nbsp;',
-            '<a href="/bugs/{dup_id}">Bug #{dup_id} {dup_title}</a></span>',
+            '<a href="/bugs/{{dup_id}}">Bug #{{dup_id}} {{dup_title}}',
+            '</a></span>',
             '<a id="change-duplicate-bug-bugtasks"',
             '    href="+duplicate"',
             '    title="Edit or remove linked duplicate bug"',
@@ -395,11 +396,8 @@
             '    href="+duplicate"',
             '    title="Remove linked duplicate bug"',
             '    class="sprite remove action-icon standalone ',
-            '    remove-duplicate-bug">Remove</a>'].join(" ");
-        return Y.Lang.substitute(info_template, {
-            dup_id: dup_id,
-            dup_title: dup_title
-        });
+            '    remove-duplicate-bug">Remove</a>'].join(" "),
+            {dup_id: dup_id, dup_title: dup_title});
     },
 
     // Render the duplicate message at the top of the bug tasks table.
@@ -429,9 +427,9 @@
      * @private
      */
     _show_comment_on_duplicate_warning: function(bug_id, title) {
-        var dupe_link = Y.Lang.substitute(
-            '<a title="{title}" id="duplicate-of-warning-link" ' +
-            'href="/bugs/{id}" style="margin-right: 4px">bug #{id}.</a>',
+        var dupe_link = Y.lp.mustache.to_html(
+            '<a title="{{title}}" id="duplicate-of-warning-link" ' +
+            'href="/bugs/{{id}}" style="margin-right: 4px">bug #{{id}}.</a>',
             {id: bug_id, title: title});
         var new_duplicate_warning = Y.Node.create(
             ['<div class="block-sprite large-warning"',
@@ -510,4 +508,4 @@
 
 }, "0.1", {"requires": [
     "base", "io", "oop", "node", "event", "json", "lp.app.errors",
-    "lp.bugs.bug_picker", "lp.bugs.bugtask_index"]});
+    "lp.mustache", "lp.bugs.bug_picker", "lp.bugs.bugtask_index"]});