From 602155bb781f509c7a4ddcd700b57cb9b9f5286d Mon Sep 17 00:00:00 2001 From: Christof Marti Date: Fri, 30 Sep 2016 17:08:23 -0700 Subject: [PATCH] Avoid backticks (fixes #13098) --- src/vs/workbench/electron-browser/actions.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/vs/workbench/electron-browser/actions.ts b/src/vs/workbench/electron-browser/actions.ts index 97a39d43114..c3793eaabc2 100644 --- a/src/vs/workbench/electron-browser/actions.ts +++ b/src/vs/workbench/electron-browser/actions.ts @@ -521,12 +521,13 @@ export class ReportIssueAction extends Action { } private generateNewIssueUrl(baseUrl: string, name: string, version: string, commit: string, date: string, isPure: boolean, extensions:ILocalExtension[]): string { + // Avoid backticks, these can trigger XSS detectors. (https://github.com/Microsoft/vscode/issues/13098) const osVersion = `${os.type()} ${os.arch()} ${os.release()}`; const queryStringPrefix = baseUrl.indexOf('?') === -1 ? '?' : '&'; const body = encodeURIComponent( `- VSCode Version: ${name} ${version}${isPure ? '' : ' **[Unsupported]**'} (${product.commit || 'Commit unknown'}, ${product.date || 'Date unknown'}) - OS Version: ${osVersion} -- Extensions: ${extensions.map(e => '`' + e.id + '`').join(', ')} +- Extensions: ${extensions.map(e => e.id).join(', ')} Steps to Reproduce: -- GitLab