Merge pull request #15606 from rabbitmq/mk-escape-x-argument-headers-in-management-ui

michaelklishin · web-flow · commit 5a16bb3aae51 · 2026-03-02T09:57:57.000-08:00
Escape x-internal-purpose used by the federation plugin
diff --git a/deps/rabbitmq_management/priv/www/js/formatters.js b/deps/rabbitmq_management/priv/www/js/formatters.js
@@ -791,7 +791,7 @@ function _link_to(name, url, highlight, args) {
     if (highlight == undefined) highlight = true;
     var title = null;
     if (args != undefined && args['x-internal-purpose'] != undefined) {
-        var purpose = args['x-internal-purpose'];
+        var purpose = fmt_escape_html(args['x-internal-purpose']);
         title = 'This is used internally by the ' + purpose + ' mechanism.';
     }
     return '<a href="' + url + '"' +

Original file line number	Diff line number	Diff line change
`@@ -791,7 +791,7 @@ function _link_to(name, url, highlight, args) {`
`791`	`791`	`if (highlight == undefined) highlight = true;`
`792`	`792`	`var title = null;`
`793`	`793`	`if (args != undefined && args['x-internal-purpose'] != undefined) {`
`794`		`- var purpose = args['x-internal-purpose'];`
	`794`	`+ var purpose = fmt_escape_html(args['x-internal-purpose']);`
`795`	`795`	`title = 'This is used internally by the ' + purpose + ' mechanism.';`
`796`	`796`	`}`
`797`	`797`	`return '<a href="' + url + '"' +`