kallithea Files · scripts/run-all-cleanup

Files @ 391fde4cbf12

Branch filter:

Location: kallithea/scripts/run-all-cleanup

391fde4cbf12 185 B text/plain Show Annotation Show as Raw Download as Raw

Mads Kiilerich

base: escape branch/tag/bookmark names in 'Switch To' menu to prevent XSS

On repository pages, the 'Switch To' did not escape branches correctly.

This means that if an attacker is able to push a branch/tag/bookmark
containing HTML/JavaScript in its name, then that code would be evaluated.
This is a cross-site scripting (XSS) vulnerability.

Fix the problem by correctly escaping the branch/tag/bookmarks with
.html_escape() .

#!/bin/sh

# Convenience script for running various idempotent source code cleanup scripts

set -e
set -x

scripts/docs-headings.py
scripts/generate-ini.py
scripts/whitespacecleanup.sh