gitweb: escape html in rss title
The title of an RSS feed is generated from many components, including the filename provided as a query parameter, but we failed to quote it. Besides showing the wrong output, this is a vector for XSS attacks. Signed-off-by: Jeff King <peff@peff.net>
Jeff King committed
Nov 12, 2012 at 16:34 UTC
0f0ecf68b31303de7cb428554e27d433fe62180e
2 files changed
+16
gitweb/gitweb.perl
+1
@@ -8055,6 +8055,7 @@ sub git_feed {
8055
$feed_type = 'history';
8056
}
8057
$title .= " $feed_type";
8058
+ $title = esc_html($title);
8059
my $descr = git_get_project_description($project);
8060
if (defined $descr) {
8061
$descr = esc_html($descr);
t/t9502-gitweb-standalone-parse-output.sh
+15
@@ -185,5 +185,20 @@ test_expect_success 'forks: project_index lists all projects (incl. forks)' '
185
test_cmp expected actual
186
'
187
188
+xss() {
189
+ echo >&2 "Checking $1..." &&
190
+ gitweb_run "$1" &&
191
+ if grep "$TAG" gitweb.body; then
192
+ echo >&2 "xss: $TAG should have been quoted in output"
193
+ return 1
194
+ fi
195
+ return 0
196
+}
197
+
198
+test_expect_success 'xss checks' '
199
+ TAG="<magic-xss-tag>" &&
200
+ xss "a=rss&p=$TAG" &&
201
+ xss "a=rss&p=foo.git&f=$TAG"
202
+'
203
204
test_done