mirror of
https://github.com/git/git
synced 2024-08-25 02:35:46 +00:00
Merge branch 'jk/maint-gitweb-xss'
Fixes an XSS vulnerability in gitweb. * jk/maint-gitweb-xss: gitweb: escape html in rss title
This commit is contained in:
commit
79a09bba1c
|
@ -8054,6 +8054,7 @@ sub git_feed {
|
|||
$feed_type = 'history';
|
||||
}
|
||||
$title .= " $feed_type";
|
||||
$title = esc_html($title);
|
||||
my $descr = git_get_project_description($project);
|
||||
if (defined $descr) {
|
||||
$descr = esc_html($descr);
|
||||
|
|
|
@ -185,5 +185,20 @@ test_expect_success 'forks: project_index lists all projects (incl. forks)' '
|
|||
test_cmp expected actual
|
||||
'
|
||||
|
||||
xss() {
|
||||
echo >&2 "Checking $1..." &&
|
||||
gitweb_run "$1" &&
|
||||
if grep "$TAG" gitweb.body; then
|
||||
echo >&2 "xss: $TAG should have been quoted in output"
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
test_expect_success 'xss checks' '
|
||||
TAG="<magic-xss-tag>" &&
|
||||
xss "a=rss&p=$TAG" &&
|
||||
xss "a=rss&p=foo.git&f=$TAG"
|
||||
'
|
||||
|
||||
test_done
|
||||
|
|
Loading…
Reference in a new issue