diff options
| author | sterni <sternenseemann@systemli.org> | 2021-01-15T13·39+0100 |
|---|---|---|
| committer | sterni <sternenseemann@systemli.org> | 2021-01-25T20·11+0000 |
| commit | 7e408c874ac9b84f62bd48a3a6f2b57bae866d29 (patch) | |
| tree | 434ff06a5e7a07bf4e8a892979df1f135e80b223 | |
| parent | 71946b84b8a9ffba3a9fa627f34e5dbabec50b4b (diff) | |
fix(panettone): escape value attr of inputs if dynamic content r/2143
I checked all :value attributes in panettone.lisp and wrapped them with who:escape-string if its value comes from user-influenced places. Static values or values from panettone internals are left as is. I did not do a comprehensive check for other places where something similar could happen though. Fixes #92. Change-Id: I134acc0d2f025f173588b37c19a93589365e879b Reviewed-on: https://cl.tvl.fyi/c/depot/+/2401 Tested-by: BuildkiteCI Reviewed-by: glittershark <grfn@gws.fyi>
| -rw-r--r-- | web/panettone/src/panettone.lisp | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/web/panettone/src/panettone.lisp b/web/panettone/src/panettone.lisp index bcf215d15828..aaf58bd1915e 100644 --- a/web/panettone/src/panettone.lisp +++ b/web/panettone/src/panettone.lisp @@ -147,7 +147,7 @@ (:form :method :post :action "/login" (:input :type "hidden" :name "original-uri" - :value original-uri) + :value (who:escape-string original-uri)) (:div (:label :for "username" "Username") @@ -251,7 +251,8 @@ :name "subject" :placeholder "Subject" :value (when editing - (subject issue)))) + (who:escape-string + (subject issue))))) (:div (:textarea :name "body" |