From 288926b44e29741dab75236cc0e0336221fca641 Mon Sep 17 00:00:00 2001 From: dgtlmoon Date: Thu, 20 Aug 2026 17:59:02 +0200 Subject: [PATCH] GHSA-4j9m-cxq4-9c36 - Improved validation Stored CSS Injection via `tag_colour` Field (#4317) --- changedetectionio/api/Tags.py | 23 ++++ changedetectionio/blueprint/tags/__init__.py | 11 ++ changedetectionio/blueprint/tags/colour.py | 36 ++++++ changedetectionio/blueprint/tags/form.py | 8 +- .../blueprint/tags/templates/edit-tag.html | 9 +- .../tags/templates/groups-overview.html | 6 +- .../watchlist/templates/watch-overview.html | 8 +- changedetectionio/tests/test_tag_colour.py | 110 ++++++++++++++++++ .../translations/cs/LC_MESSAGES/messages.mo | Bin 55317 -> 55429 bytes .../translations/cs/LC_MESSAGES/messages.po | 4 + .../translations/de/LC_MESSAGES/messages.mo | Bin 50817 -> 50922 bytes .../translations/de/LC_MESSAGES/messages.po | 4 + .../en_GB/LC_MESSAGES/messages.po | 4 + .../en_US/LC_MESSAGES/messages.po | 4 + .../translations/es/LC_MESSAGES/messages.mo | Bin 71351 -> 71460 bytes .../translations/es/LC_MESSAGES/messages.po | 4 + .../translations/fr/LC_MESSAGES/messages.mo | Bin 37821 -> 37937 bytes .../translations/fr/LC_MESSAGES/messages.po | 4 + .../translations/it/LC_MESSAGES/messages.mo | Bin 22610 -> 22722 bytes .../translations/it/LC_MESSAGES/messages.po | 4 + .../translations/ja/LC_MESSAGES/messages.mo | Bin 89113 -> 89246 bytes .../translations/ja/LC_MESSAGES/messages.po | 4 + .../translations/ko/LC_MESSAGES/messages.mo | Bin 102613 -> 102720 bytes .../translations/ko/LC_MESSAGES/messages.po | 4 + changedetectionio/translations/messages.pot | 6 +- .../pt_BR/LC_MESSAGES/messages.mo | Bin 69539 -> 69647 bytes .../pt_BR/LC_MESSAGES/messages.po | 4 + .../translations/ru/LC_MESSAGES/messages.mo | Bin 139537 -> 139687 bytes .../translations/ru/LC_MESSAGES/messages.po | 4 + .../translations/tr/LC_MESSAGES/messages.mo | Bin 70442 -> 70552 bytes .../translations/tr/LC_MESSAGES/messages.po | 4 + .../translations/uk/LC_MESSAGES/messages.mo | Bin 83959 -> 84103 bytes .../translations/uk/LC_MESSAGES/messages.po | 4 + .../translations/zh/LC_MESSAGES/messages.mo | Bin 58285 -> 58388 bytes .../translations/zh/LC_MESSAGES/messages.po | 4 + .../zh_Hant_TW/LC_MESSAGES/messages.mo | Bin 44544 -> 44647 bytes .../zh_Hant_TW/LC_MESSAGES/messages.po | 4 + docs/api-spec.yaml | 7 ++ docs/api_v1/index.html | 36 ++++-- 39 files changed, 301 insertions(+), 19 deletions(-) create mode 100644 changedetectionio/blueprint/tags/colour.py create mode 100644 changedetectionio/tests/test_tag_colour.py diff --git a/changedetectionio/api/Tags.py b/changedetectionio/api/Tags.py index ae09dfe2..0b001442 100644 --- a/changedetectionio/api/Tags.py +++ b/changedetectionio/api/Tags.py @@ -10,6 +10,21 @@ from . import auth from . import validate_openapi_request, strip_internal_api_fields +def validate_tag_colour(json_data): + """Return an error message when tag_colour is set to anything but a hex colour. + + The value is rendered into a