mirror/Part-DB.Part-DB-server
1
0
Fork 1
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2025-06-30 13:34:28 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

vulnerability XSS fix

Browse source 
The "trans with" command is not automatically escaping the string, so this is a XSS (Cross-Site Scripting) vulnerability.
Tested string: https://URL-TO-PART-DB-SERVER/de/parts/search?keyword=%22'%3E%3Cqss%20a%3D X147208852Y1_1Z%3E

QUALYS Enterprise WAS Scan Report classifies this as level 5 security risk
This commit is contained in:
Sascha Lenk 2023-02-25 22:42:03 +01:00 • committed by GitHub
parent b70c9d4f00
commit dc906bfb0f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
templates/parts/lists/search_list.html.twig
View file

@ -16,7 +16,7 @@
</div> </div>
<div id="searchInfo" class="accordion-collapse collapse" data-bs-parent="#listAccordion"> <div id="searchInfo" class="accordion-collapse collapse" data-bs-parent="#listAccordion">
<div class="accordion-body"> <div class="accordion-body">
<h4>{% trans with {"%keyword%": keyword} %}parts_list.search.searching_for{% endtrans %}</h4> <h4>{% trans with {"%keyword%": keyword|escape} %}parts_list.search.searching_for{% endtrans %}</h4>
{% trans %}parts_list.search_options.caption{% endtrans %}: {% trans %}parts_list.search_options.caption{% endtrans %}: