projects / project / luci.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: a0c73fa) | patch
luci-base: dispatcher.lua: prevent XSS through 404 error template
authorJo-Philipp Wich <jo@mein.io>
Fri, 10 Mar 2023 14:09:04 +0000 (15:09 +0100)
committerJo-Philipp Wich <jo@mein.io>
Fri, 10 Mar 2023 14:37:36 +0000 (15:37 +0100)
commit5f30aa0e19edc5952ac8e74707597eb095ebc714
tree0714b85977bb203ddf575236b97c536ccba319e7tree | snapshot
parenta0c73faf502684bca2ffbdab511510f37d799b76commit | diff
luci-base: dispatcher.lua: prevent XSS through 404 error template

Make sure to escape the user controlled URL passed as part of the error
message into the error404 template in order to avoid XSS.

Reported-by: 40826d <40826d@posteo.de>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commit cd8bea94e61fa72a0a2ba7bc54d7b2d7b7572519)
modules/luci-base/luasrc/dispatcher.lua diff | blob | history
Lua Configuration Interface (mirror)