Sanitize params

wnbrb · Oct 25, 2023 · bb60b38 · bb60b38
1 parent db324f2
commit bb60b38
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/app/views/site/past_meetup.erb b/app/views/site/past_meetup.erb
@@ -1,7 +1,7 @@
 <%= javascript_pack_tag 'past_meetup' %>
 <%= stylesheet_pack_tag "past_meetup" %>
 <%= javascript_tag do %>
-  var year = <%= raw(params[:year]) %>
-  var month = <%= raw(params[:month]) %>
-  var day = <%= raw(params[:day]) %>
-<% end %>
+  var year = <%= raw(h(params[:year])) %>;
+  var month = <%= raw(h(params[:month])) %>;
+  var day = <%= raw(h(params[:day])) %>;
+<% end %>