From 92f27ed0be327ab6acb61aeedf7a77702cc6c25f Mon Sep 17 00:00:00 2001 From: Eric Wong Date: Tue, 14 Mar 2017 21:23:39 +0000 Subject: view: escape HTML description name Otherwise funky filenames can cause HTML injection vulnerabilities (hope you have JavaScript disabled!) --- lib/PublicInbox/View.pm | 1 + t/view.t | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/PublicInbox/View.pm b/lib/PublicInbox/View.pm index 0b1ec75b..9ef4712f 100644 --- a/lib/PublicInbox/View.pm +++ b/lib/PublicInbox/View.pm @@ -438,6 +438,7 @@ sub attach_link ($$$$;$) { } $ret .= "[-- Attachment #$idx: "; my $ts = "Type: $ct, Size: $size bytes"; + $desc = ascii_html($desc); $ret .= ($desc eq '') ? "$ts --]" : "$desc --]\n[-- $ts --]"; $ret .= "\n"; } diff --git a/t/view.t b/t/view.t index 46fbe410..2181b5ef 100644 --- a/t/view.t +++ b/t/view.t @@ -124,7 +124,7 @@ EOF Email::MIME->create( attributes => { content_type => 'text/plain', - filename => "foo.patch", + filename => "foo&.patch", }, body => "--- a/file\n+++ b/file\n" . "@@ -49, 7 +49,34 @@\n", @@ -140,7 +140,7 @@ EOF ); my $html = msg_html($mime); - like($html, qr!.*Attachment #2: foo\.patch --!, + like($html, qr!.*Attachment #2: foo&(?:amp|#38);\.patch --!, "parts split with filename"); } -- cgit v1.2.3-24-ge0c7