[FIXED SECURITY-76] Prevent iframe injection, forbid iframe by default

535c1115 · Vojtech Juranek · Jesse Glick · 8ac74c35 · 535c1115
隐藏空白更改
内联并排

Showing with 0 addition and 1 deletion

core/src/main/java/hudson/markup/MyspacePolicy.java core/src/main/java/hudson/markup/MyspacePolicy.java +0 -1

未找到文件。
--- a/core/src/main/java/hudson/markup/MyspacePolicy.java
+++ b/core/src/main/java/hudson/markup/MyspacePolicy.java
@@ -66,7 +66,6 @@ public class MyspacePolicy {
            tag("span,div");
            tag("img",      "src",ONSITE_OR_OFFSITE_URL,
                            "hspace","vspace");
-            tag("iframe",   "src");
            tag("link",     "type","rel");
            tag("ul,ol,li,dd,dl,dt,thead,tbody,tfoot");
            tag("table",    "noresize");