mirror of https://github.com/openwrt/luci.git
76a7614620
normalize_assets() rejects .. and whitespace but not quotes or angle
brackets, and every sysauth template interpolates the surviving src
straight into an attribute without escaping:
<script src="{{ asset.src }}"></script>
A src of /luci-static/plugins/<uuid>/x.js"></script><script>... passes
both existing checks and closes the attribute. It needs no whitespace,
so the existing character class does not stop it.
The three in-tree templates could entityencode() instead, but
normalize_assets() is the single point every theme goes through, so
filtering here also covers out-of-tree themes carrying the same markup.
src comes from a plugin's own check(), which is server-side ucode able
to emit script through the html field regardless, so this is not a
privilege boundary. It matters for a plugin deriving src from request
input, and it keeps the filter consistent with what it already tries to
do.
Signed-off-by: Fuad Hasan <fuad.antor@gmail.com>
|
||
|---|---|---|
| .. | ||
| luci-base | ||
| luci-compat | ||
| luci-lua-runtime | ||
| luci-mod-admin-full | ||
| luci-mod-battstatus | ||
| luci-mod-dashboard | ||
| luci-mod-dsl | ||
| luci-mod-network | ||
| luci-mod-status | ||
| luci-mod-system | ||