diff options
| author | Todd Zullinger <tmz@pobox.com> | 2011-07-22 09:45:40 -0400 |
|---|---|---|
| committer | Todd Zullinger <tmz@pobox.com> | 2011-07-22 09:45:40 -0400 |
| commit | bb87dd973f2253b81a2d8486e776915f7eec7f9a (patch) | |
| tree | d4a8256a6e6e315a871af0652ad14a11eb52ef15 | |
| parent | e92f1273b50942b4c92c7367921f3fe8783ae78d (diff) | |
| download | cgit_EL6-bb87dd973f2253b81a2d8486e776915f7eec7f9a.tar.gz | |
Add XSS patch file
| -rw-r--r-- | 0001-Fix-potential-XSS-vulnerability-in-rename-hint.patch | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/0001-Fix-potential-XSS-vulnerability-in-rename-hint.patch b/0001-Fix-potential-XSS-vulnerability-in-rename-hint.patch new file mode 100644 index 0000000..9344e77 --- /dev/null +++ b/0001-Fix-potential-XSS-vulnerability-in-rename-hint.patch @@ -0,0 +1,39 @@ +From bebe89d7c11a92bf206bf6e528c51ffa8ecbc0d5 Mon Sep 17 00:00:00 2001 +From: Lukas Fleischer <cgit@cryptocrack.de> +Date: Fri, 22 Jul 2011 13:47:19 +0200 +Subject: [PATCH] Fix potential XSS vulnerability in rename hint + +The file name displayed in the rename hint should be escaped to avoid +XSS. Note that this vulnerability is only applicable when an attacker +has gained push access to the repository. + +Signed-off-by: Lukas Fleischer <cgit@cryptocrack.de> +Signed-off-by: Lars Hjemli <hjemli@gmail.com> +--- + ui-diff.c | 10 ++++++---- + 1 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/ui-diff.c b/ui-diff.c +index d21541b..383a534 100644 +--- a/ui-diff.c ++++ b/ui-diff.c +@@ -97,10 +97,12 @@ static void print_fileinfo(struct fileinfo *info) + htmlf("</td><td class='%s'>", class); + cgit_diff_link(info->new_path, NULL, NULL, ctx.qry.head, ctx.qry.sha1, + ctx.qry.sha2, info->new_path, 0); +- if (info->status == DIFF_STATUS_COPIED || info->status == DIFF_STATUS_RENAMED) +- htmlf(" (%s from %s)", +- info->status == DIFF_STATUS_COPIED ? "copied" : "renamed", +- info->old_path); ++ if (info->status == DIFF_STATUS_COPIED || info->status == DIFF_STATUS_RENAMED) { ++ htmlf(" (%s from ", ++ info->status == DIFF_STATUS_COPIED ? "copied" : "renamed"); ++ html_txt(info->old_path); ++ html(")"); ++ } + html("</td><td class='right'>"); + if (info->binary) { + htmlf("bin</td><td class='graph'>%ld -> %ld bytes", +-- +1.7.6.rc1 + |