From e76149c71aff24b3e130e2b31fbb8192f667ee67 Mon Sep 17 00:00:00 2001
From: catborise <catborise@gmail.com>
Date: Fri, 2 Oct 2026 22:34:05 +0300
Subject: [PATCH] fix: serve compute JSON endpoints as application/json, build
 chipset list safely

compute_graph (text/javascript) and the machine type, disk bus, video
model and domain capability views (text/html) return JSON; send it as
application/json. create_instance_w1.html builds the chipset <option>
elements with .val().text() instead of string concatenation.
---
 computes/views.py                           | 13 +++++--------
 instances/templates/create_instance_w1.html |  9 +++------
 instances/test_xss.py                       | 18 ++++++++++++++++++
 3 files changed, 26 insertions(+), 14 deletions(-)

diff --git a/computes/views.py b/computes/views.py
index 22b7c3ec..2b328652 100644
--- a/computes/views.py
+++ b/computes/views.py
@@ -141,10 +141,7 @@ def compute_graph(request, compute_id):
     comp_mgr = ComputeManager(compute_id)
     data = comp_mgr.compute_graph()
 
-    response = HttpResponse()
-    response["Content-Type"] = "text/javascript"
-    response.write(data)
-    return response
+    return HttpResponse(data, content_type="application/json")
 
 
 def get_compute_disk_buses(request, compute_id, arch, machine, disk):
@@ -157,7 +154,7 @@ def get_compute_disk_buses(request, compute_id, arch, machine, disk):
     :return:
     """
     comp_mgr = ComputeManager(compute_id)
-    return HttpResponse(comp_mgr.get_disk_buses(arch, machine, disk))
+    return HttpResponse(comp_mgr.get_disk_buses(arch, machine, disk), content_type="application/json")
 
 
 def get_compute_machine_types(request, compute_id, arch):
@@ -168,7 +165,7 @@ def get_compute_machine_types(request, compute_id, arch):
     :return:
     """
     comp_mgr = ComputeManager(compute_id)
-    return HttpResponse(comp_mgr.get_machine_types(arch))
+    return HttpResponse(comp_mgr.get_machine_types(arch), content_type="application/json")
 
 
 def get_compute_video_models(request, compute_id, arch, machine):
@@ -180,7 +177,7 @@ def get_compute_video_models(request, compute_id, arch, machine):
     :return:
     """
     comp_mgr = ComputeManager(compute_id)
-    return HttpResponse(comp_mgr.get_video_models(arch, machine))
+    return HttpResponse(comp_mgr.get_video_models(arch, machine), content_type="application/json")
 
 
 def get_dom_capabilities(request, compute_id, arch, machine):
@@ -192,7 +189,7 @@ def get_dom_capabilities(request, compute_id, arch, machine):
     :return:
     """
     comp_mgr = ComputeManager(compute_id)
-    return HttpResponse(comp_mgr.get_dom_capabilities(arch, machine))
+    return HttpResponse(comp_mgr.get_dom_capabilities(arch, machine), content_type="application/json")
 
 
 class ComputeManager:
diff --git a/instances/templates/create_instance_w1.html b/instances/templates/create_instance_w1.html
index 93a915d3..d47f03f9 100644
--- a/instances/templates/create_instance_w1.html
+++ b/instances/templates/create_instance_w1.html
@@ -106,12 +106,9 @@
             $("#select_chipset").find('option').remove();
             $("#select_archs").val(arch);
             $.each(data['machines'], function(i, item) {
-                if (item == '{{ default_machine }}') {
-                    var selected = 'selected';
-                }else{
-                    var selected = '';
-                }
-                $("#select_chipset").append('<option value="' + item + '"' + selected +'>' + item + '</option>');
+                $("#select_chipset").append(
+                    $("<option>").val(item).text(item).prop("selected", item == '{{ default_machine }}')
+                );
             });
         });
     }
diff --git a/instances/test_xss.py b/instances/test_xss.py
index 3a8537c8..b6867ca9 100644
--- a/instances/test_xss.py
+++ b/instances/test_xss.py
@@ -81,6 +81,20 @@ class JsonEndpointContentTypeTestCase(TestCase):
             self.client.get(reverse("ds_openstack_metadata", args=["latest"]))
         )
 
+    def test_compute_json_endpoints_are_json(self):
+        urls = [
+            reverse("compute_graph", args=[self.compute.id]),
+            reverse("machines", args=[self.compute.id, "x86_64"]),
+            reverse("buses", args=[self.compute.id, "x86_64", "q35", "disk"]),
+            reverse("domcaps", args=[self.compute.id, "x86_64", "q35"]),
+        ]
+        with patch("computes.views.ComputeManager") as mock_mgr:
+            for method in ("compute_graph", "get_machine_types", "get_disk_buses", "get_dom_capabilities"):
+                getattr(mock_mgr.return_value, method).return_value = "{}"
+            for url in urls:
+                with self.subTest(url=url):
+                    self.assertJson(self.client.get(url))
+
     def test_vm_logs_is_json(self):
         self.assertJson(self.client.get(reverse("vm_logs", args=[self.instance.name])))
 
@@ -106,6 +120,10 @@ class TemplateHtmlConcatenationTestCase(TestCase):
         self.assertNotIn("'<option value=' + item", src)
         self.assertNotIn('pool + "<span', src)
 
+    def test_create_wizard_chipset_list_does_not_concatenate_into_html(self):
+        src = self._read("instances/templates/create_instance_w1.html")
+        self.assertNotIn("""append('<option value="' + item""", src)
+
     def test_create_wizard_volume_lists_do_not_concatenate_volume_names_into_html(self):
         src = self._read("instances/templates/create_instance_w2.html")
         self.assertNotIn("'<option value=' + item", src)