github/bird-lg-go
1
Fork 0
mirror of https://github.com/xddxdd/bird-lg-go synced 2025-02-16 10:34:27 +01:00
Code Releases Activity

frontend: disable escaping of special HTML chars for BGPMap graph

Browse Source
This commit is contained in:
Lan Tian 2024-07-01 21:16:43 -07:00
parent f0f072c4a6
commit 0dd1c07b66
No known key found for this signature in database
GPG Key ID: 04E66B6B25A0862B
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
frontend/bgpmap_graph.go
View File

@ -1,6 +1,7 @@
package main
import (
"bytes"
"encoding/json"
"fmt"
"strings"
@ -69,11 +70,15 @@ func (graph *RouteGraph) attrsToString(attrs RouteAttrs) string {
}
func (graph *RouteGraph) escape(s string) string {
result, err := json.Marshal(s)
buffer := &bytes.Buffer{}
encoder := json.NewEncoder(buffer)
encoder.SetEscapeHTML(false)
err := encoder.Encode(s)
if err != nil {
return err.Error()
} else {
return string(result)
return string(buffer.Bytes())
}
}

2
frontend/bgpmap_test.go
View File

@ -33,7 +33,7 @@ func TestBirdRouteToGraphvizXSS(t *testing.T) {
fakeResult,
}, fakeResult)
if strings.Contains(result, "<script>") {
if strings.Contains(result, fakeResult) {
t.Errorf("XSS injection succeeded: %s", result)
}
}