mirrors/copyparty
1
0
Fork 0
mirror of https://github.com/9001/copyparty.git synced 2025-08-17 09:02:15 -06:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix GHSA-cw7j-v52w-fp5r: reflected-XSS through /?hc

Browse source
This commit is contained in:
ed 2023-07-21 00:35:43 +00:00
parent a1bb10012d
commit 0778da6c4d
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
copyparty/httpcli.py
View file

@ -2985,7 +2985,9 @@ class HttpCli(object):
if self.args.rclone_mdns or not self.args.zm if self.args.rclone_mdns or not self.args.zm
else self.conn.hsrv.nm.map(self.ip) or host else self.conn.hsrv.nm.map(self.ip) or host
) )
vp = (self.uparam["hc"] or "").lstrip("/") # safer than html_escape/quotep since this avoids both XSS and shell-stuff
pw = re.sub(r"[<>&$?`]", "_", self.pw or "pw")
vp = re.sub(r"[<>&$?`]", "_", self.uparam["hc"] or "").lstrip("/")
html = self.j2s( html = self.j2s(
"svcs", "svcs",
args=self.args, args=self.args,
@ -2998,7 +3000,7 @@ class HttpCli(object):
host=host, host=host,
hport=hport, hport=hport,
aname=aname, aname=aname,
pw=self.pw or "pw", pw=pw,
) )
self.reply(html.encode("utf-8")) self.reply(html.encode("utf-8"))
return True return True