about summary refs log tree commit diff
path: root/web
diff options
context:
space:
mode:
authorsterni <sternenseemann@systemli.org>2021-01-15T13·39+0100
committersterni <sternenseemann@systemli.org>2021-01-25T20·11+0000
commit7e408c874ac9b84f62bd48a3a6f2b57bae866d29 (patch)
tree434ff06a5e7a07bf4e8a892979df1f135e80b223 /web
parent71946b84b8a9ffba3a9fa627f34e5dbabec50b4b (diff)
fix(panettone): escape value attr of inputs if dynamic content r/2143
I checked all :value attributes in panettone.lisp and wrapped them with
who:escape-string if its value comes from user-influenced places. Static
values or values from panettone internals are left as is.

I did not do a comprehensive check for other places where something
similar could happen though.

Fixes #92.

Change-Id: I134acc0d2f025f173588b37c19a93589365e879b
Reviewed-on: https://cl.tvl.fyi/c/depot/+/2401
Tested-by: BuildkiteCI
Reviewed-by: glittershark <grfn@gws.fyi>
Diffstat (limited to 'web')
-rw-r--r--web/panettone/src/panettone.lisp5
1 files changed, 3 insertions, 2 deletions
diff --git a/web/panettone/src/panettone.lisp b/web/panettone/src/panettone.lisp
index bcf215d15828..aaf58bd1915e 100644
--- a/web/panettone/src/panettone.lisp
+++ b/web/panettone/src/panettone.lisp
@@ -147,7 +147,7 @@
       (:form
        :method :post :action "/login"
        (:input :type "hidden" :name "original-uri"
-               :value original-uri)
+               :value (who:escape-string original-uri))
        (:div
         (:label :for "username"
                 "Username")
@@ -251,7 +251,8 @@
                        :name "subject"
                        :placeholder "Subject"
                        :value (when editing
-                                (subject issue))))
+                                (who:escape-string
+                                  (subject issue)))))
 
               (:div
                (:textarea :name "body"