Re: [BUG] gitweb: XSS vulnerability of RSS feed
- From
Junio C Hamano <gitster@pobox.com>
- Date
- Nov 12, 2012, 20:36 UTC
- Message-ID
- <7vmwymh83r.fsf@alter.siamese.dyndns.org>
- In-Reply-To
- <20121112202701.GE4623@sigill.intra.peff.net>
Jeff King <peff@peff.net> writes:
Show 21 quoted lines
> On Mon, Nov 12, 2012 at 03:24:13PM -0500, Jeff King wrote:
>
>> I think the right answer is going to be a well-placed call to esc_html.
>
> I'm guessing the right answer is this:
>
> diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
> index 10ed9e5..a51a8ba 100755
> --- a/gitweb/gitweb.perl
> +++ b/gitweb/gitweb.perl
> @@ -8055,6 +8055,7 @@ sub git_feed {
> $feed_type = 'history';
> }
> $title .= " $feed_type";
> + $title = esc_html($title);
> my $descr = git_get_project_description($project);
> if (defined $descr) {
> $descr = esc_html($descr);
>
> but I did not test it (and I am not that familiar with gitweb, so it is
> a slight guess from spending 5 minutes grepping and reading).Yeah, that looks correct, given the way how the other variables emitted with the same "print" like $descr and $owner are formed.