From: schwarze@mandoc.bsd.lv
To: source@mandoc.bsd.lv
Subject: cvsweb: Patch from Peter J.
Date: Thu, 21 Mar 2019 17:58:53 -0500 (EST) [thread overview]
Message-ID: <e3fc87ef459abbc2@fantadrom.bsd.lv> (raw)
Log Message:
-----------
Patch from Peter J. Philipp <pjp at centroid dot eu>
to fix some opportunities for XSS;
triggered by a report from Ezio Paglia
Tags:
----
FreeBSD-cvsweb-2_0-branch
Modified Files:
--------------
cvsweb:
cvsweb.cgi
Revision Data
-------------
Index: cvsweb.cgi
===================================================================
RCS file: /home/cvs/mandoc/cvsweb/cvsweb.cgi,v
retrieving revision 3.119.2.14
retrieving revision 3.119.2.15
diff -Lcvsweb.cgi -Lcvsweb.cgi -u -p -r3.119.2.14 -r3.119.2.15
--- cvsweb.cgi
+++ cvsweb.cgi
@@ -989,8 +989,9 @@ if (-d $fullname) {
if (scalar %tags || $input{only_with_tag}) {
print "<form method=\"get\" action=\"./\">\n";
foreach my $var (@stickyvars) {
+ my $tmpvar = htmlquote($input{$var});
print
- "<input type=\"hidden\" name=\"$var\" value=\"$input{$var}\">\n"
+ "<input type=\"hidden\" name=\"$var\" value=\"$tmpvar\">\n"
if (defined($input{$var})
&& (!defined($DEFAULTVALUE{$var})
|| $input{$var} ne $DEFAULTVALUE{$var})
@@ -2612,7 +2613,7 @@ sub printLog($;$) {
sprintf(
'%s/%s?annotate=%s%s', $scriptname,
urlencode($where), $_,
- $barequery
+ htmlquote($barequery)
)
);
}
@@ -2625,7 +2626,7 @@ sub printLog($;$) {
'[select for diffs]',
sprintf(
'%s?r1=%s%s', $scriptwhere,
- $_, $barequery
+ $_, htmlquote($barequery)
)
);
} else {
@@ -2828,7 +2829,7 @@ sub doLog($) {
foreach (@stickyvars) {
printf('<input type="hidden" name="%s" value="%s">', $_,
- $input{$_})
+ htmlquote($input{$_}))
if (defined($input{$_})
&& ((!defined($DEFAULTVALUE{$_})
|| $input{$_} ne $DEFAULTVALUE{$_}) && $input{$_} ne ""));
@@ -3267,7 +3268,7 @@ sub clickablePath($$) {
join ('', $scriptname,
urlencode($wherepath),
(!$last || $lastslash ? '/' : ''),
- $query,
+ htmlquote($query),
(!$last || $lastslash ? "#dirlist" : "")
));
} else { # do not make a link to the current dir
@@ -3508,6 +3509,7 @@ sub htmlquote($) {
# Special Characters; RFC 1866
s/&/&/g;
s/\"/"/g;
+ s/%22/"/g;
s/</</g;
s/>/>/g;
--
To unsubscribe send an email to source+unsubscribe@mandoc.bsd.lv
reply other threads:[~2019-03-21 22:58 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e3fc87ef459abbc2@fantadrom.bsd.lv \
--to=schwarze@mandoc.bsd.lv \
--cc=source@mandoc.bsd.lv \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).