mirror/git
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2024-09-28 04:10:41 +02:00
Code

gitweb: escape html in rss title

Browse Source 
The title of an RSS feed is generated from many components,
including the filename provided as a query parameter, but we
failed to quote it.  Besides showing the wrong output, this
is a vector for XSS attacks.

Signed-off-by: Jeff King <peff@peff.net>
This commit is contained in:
Jeff King 2012-11-12 16:34:28 -05:00
parent 7e2010537e
commit 0f0ecf68b3
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
gitweb/gitweb.perl
View File

@ -8055,6 +8055,7 @@ sub git_feed {
$feed_type = 'history';
}
$title .= " $feed_type";
$title = esc_html($title);
my $descr = git_get_project_description($project);
if (defined $descr) {
$descr = esc_html($descr);

15
t/t9502-gitweb-standalone-parse-output.sh
View File

@ -185,5 +185,20 @@ test_expect_success 'forks: project_index lists all projects (incl. forks)' '
test_cmp expected actual
'
xss() {
echo >&2 "Checking $1..." &&
gitweb_run "$1" &&
if grep "$TAG" gitweb.body; then
echo >&2 "xss: $TAG should have been quoted in output"
return 1
fi
return 0
}
test_expect_success 'xss checks' '
TAG="<magic-xss-tag>" &&
xss "a=rss&p=$TAG" &&
xss "a=rss&p=foo.git&f=$TAG"
'
test_done