mirrors/urbackup_backend
2
0
Fork 0
mirror of https://github.com/uroni/urbackup_backend.git synced 2025-10-26 11:36:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent XSS with action parameter

Browse Source
This commit is contained in:
Martin 2017-11-29 15:37:00 +01:00
parent 235489181f
commit b3585e90e1
4 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
WorkerThread.cpp
View File

@ -244,7 +244,7 @@ void CWorkerThread::ProcessRequest(CClient *client, FCGIRequest *req)
if( tid==0 )
{
std::string error="Error: Unknown action ["+iter2->second+"]";
std::string error="Error: Unknown action ["+ EscapeHTML(iter2->second)+"]";
Server->Log(error, LL_WARNING);
try
{

2
httpserver/HTTPAction.cpp
View File

@ -99,7 +99,7 @@ void CHTTPAction::operator()(void)
if( tid==0 )
{
std::string error="Error: Unknown action ["+name+"]";
std::string error="Error: Unknown action ["+EscapeHTML(name)+"]";
Server->Log(error, LL_WARNING);
output->Write("Content-type: text/html; charset=UTF-8\r\n\r\n"+error);
}

18
stringtools.cpp
View File

@ -1198,6 +1198,24 @@ std::string UnescapeHTML(const std::string &html)
ret=greplace(">", ">", ret);
ret=greplace(""", "\"", ret);
ret=greplace("'", "'", ret);
ret = greplace("&#x2F", "/", ret);
return ret;
}
std::string EscapeHTML(const std::string & html)
{
std::string ret;
ret.reserve(html.size());
for (size_t i = 0; i < html.size(); ++i)
{
if (html[i] == '<') ret += "&lt;";
else if (html[i] == '>') ret += "&gt;";
else if (html[i] == '&') ret += "&amp;";
else if (html[i] == '\"') ret += "&quot;";
else if (html[i] == '\'') ret += "&#x27;";
else if (html[i] == '/') ret += "&#x2F";
else ret += html[i];
}
return ret;
}

1
stringtools.h
View File

@ -75,6 +75,7 @@ std::string trim(const std::string &str);
void replaceNonAlphaNumeric(std::string &str, char rch);
std::string conv_filename(std::string fn);
std::string UnescapeHTML(const std::string &html);
std::string EscapeHTML(const std::string &html);
std::string PrettyPrintBytes(_i64 bytes);
std::string PrettyPrintSpeed(size_t bps);
std::string PrettyPrintTime(int64 ms);