Mercurial > kallithea
changeset 7545:109b068ba6e5
templates/summary: escape branch/tag/bookmark names in 'Download as zip' links to prevent XSS
On a repository summary page, in the 'Download' section where you can
download an archive of the repository at a given revision, the branch/tag
names were not correctly escaped.
This means that if an attacker is able to push a branch/tag/bookmark
containing HTML/JavaScript in its name, then that code would be evaluated.
This is a cross-site scripting (XSS) vulnerability.
Fix the problem by correctly escaping the branch/tag/bookmarks.
Reported by Bob Hogg <wombat@rwhogg.site> (thanks!).
author | Mads Kiilerich <mads@kiilerich.com> |
---|---|
date | Mon, 11 Feb 2019 21:36:55 +0100 |
parents | 2ac4499b25eb |
children | 391fde4cbf12 |
files | kallithea/templates/summary/summary.html |
diffstat | 1 files changed, 1 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/kallithea/templates/summary/summary.html Sat Jan 26 20:27:50 2019 +0100 +++ b/kallithea/templates/summary/summary.html Mon Feb 11 21:36:55 2019 +0100 @@ -298,7 +298,7 @@ var title_tmpl = ${h.jshtml(_('Download %s as %s') % ('__CS_NAME__','__CS_EXT__'))}; title_tmpl= title_tmpl.replace('__CS_NAME__',new_cs.text); title_tmpl = title_tmpl.replace('__CS_EXT__',k); - title_tmpl = '<i class="icon-file-zip"></i>'+ title_tmpl; + title_tmpl = '<i class="icon-file-zip"></i>'+ title_tmpl.html_escape(); var url = tmpl_links[k].replace('__CS__',new_cs.id); var subrepos = $('#archive_subrepos').is(':checked'); url = url.replace('__SUB__',subrepos);