projects / project / luci.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: f99e4ed) | patch
luci-mod-status: fix potential XSS via specially crafted DNS names
authorJo-Philipp Wich <jo@mein.io>
Wed, 12 May 2021 09:49:31 +0000 (11:49 +0200)
committerJo-Philipp Wich <jo@mein.io>
Wed, 12 May 2021 09:57:21 +0000 (11:57 +0200)
commit3c66c5b1651aa25afbff09bee45047da9a0ba43d
tree405e4675d61de7359375813f5942dd1e208dec64tree | snapshot
parentf99e4edcc986cd8443f8e7aaab067befd562e14acommit | diff
luci-mod-status: fix potential XSS via specially crafted DNS names

When an upstream NS returns PTR domain names containing HTML, it is
added verbatim to the connection status table.

Prevent this issue by HTML escaping any values in the source and
destination columns.

Fixes: CVE-2021-32019
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
modules/luci-mod-status/htdocs/luci-static/resources/view/status/connections.js diff | blob | history
Lua Configuration Interface (mirror)