kallithea Changeset - 04e44ea05c5f

Changeset - 04e44ea05c5f

Parent rev.

Child rev.

[Not reviewed]

stable

0 1 0

Thomas De Schampheleire - 7 years ago 2019-02-26 21:27:42
thomas.de_schampheleire@nokia.com

compare: prevent XSS due to unescaped branch/tag/bookmark names

In the revision selection dropdown of the 'Compare' functionality, the
branch/tag/bookmark names were not correctly escaped.

This means that if an attacker is able to push a branch/tag/bookmark
containing HTML/JavaScript in its name, then that code would be evaluated.
This is a cross-site scripting (XSS) vulnerability.

Fix the problem by correctly escaping the branch/tag/bookmarks.

1 file changed with 1 insertions and 1 deletions:

kallithea/templates/compare/compare_diff.html

0 comments (0 inline, 0 general)

kallithea/templates/compare/compare_diff.html

➞

Show inline comments

@@ @@ -101,7 +101,7 @@ ${self.repo_context_bar('changelog')} @@
       $(css_selector).select2({
         placeholder: placeholder,
         formatSelection: function(obj){
             return '{0}@{1}'.format(repo_name, obj.text);
+            return '{0}@{1}'.format(repo_name, obj.text).html_escape();
         },
         dropdownAutoWidth: true,
         query: function(query){

0 comments (0 inline, 0 general)