Closed breckenedge closed 6 years ago
delayed_job_web 1.4.2 was released, please update and reply back here if it's working ok.
delayed_job_web 1.4.2 was released, please update and reply back here if it's working ok.
Thank you! It's deployed and working OK.
Triggered by including HTML in the
queues
param which is then combined with an A tag in raw HTML via theurl_path
(aliasu
) helper. Fixed by adding a CGI escape to the helper.https://nvd.nist.gov/vuln/detail/CVE-2017-12097