kallithea Files · MANIFEST.in

Files @ 04e44ea05c5f

Branch filter:

Location: kallithea/MANIFEST.in - annotation

04e44ea05c5f 839 B text/plain Show Source Show as Raw Download as Raw

Thomas De Schampheleire

compare: prevent XSS due to unescaped branch/tag/bookmark names

In the revision selection dropdown of the 'Compare' functionality, the
branch/tag/bookmark names were not correctly escaped.

This means that if an attacker is able to push a branch/tag/bookmark
containing HTML/JavaScript in its name, then that code would be evaluated.
This is a cross-site scripting (XSS) vulnerability.

Fix the problem by correctly escaping the branch/tag/bookmarks.

ff08d3cf9aef
ff08d3cf9aef
ff08d3cf9aef
ff08d3cf9aef
ff08d3cf9aef
ff08d3cf9aef
ff08d3cf9aef
ff08d3cf9aef
2d7a94f3eaae
0e6035a85980
ff08d3cf9aef
ff08d3cf9aef
ff08d3cf9aef
ff08d3cf9aef
ff08d3cf9aef
ff08d3cf9aef
7e5f8c12a3fc
ff08d3cf9aef
ff08d3cf9aef
19267f233d39
ff08d3cf9aef

include           Apache-License-2.0.txt
include           CONTRIBUTORS
include           COPYING
include           LICENSE-MERGELY.html
include           LICENSE.md
include           MIT-Permissive-License.txt
include           README.rst
include           development.ini
recursive-include docs *
recursive-include init.d *
include           kallithea/bin/ldap_sync.conf
include           kallithea/bin/template.ini.mako
include           kallithea/config/deployment.ini_tmpl
recursive-include kallithea/i18n *
recursive-include kallithea/lib/dbmigrate *.py_tmpl README migrate.cfg
recursive-include kallithea/public *
recursive-include kallithea/templates *
recursive-include kallithea/tests/fixtures *
recursive-include kallithea/tests/scripts *
include           kallithea/tests/test.ini
include           kallithea/tests/vcs/aconfig