404 messages shouldn't display the requested path without escaping#1070
Closed
cdmalon wants to merge 5 commits intoPerlDancer:masterfrom
Closed
404 messages shouldn't display the requested path without escaping#1070cdmalon wants to merge 5 commits intoPerlDancer:masterfrom
cdmalon wants to merge 5 commits intoPerlDancer:masterfrom
Conversation
Dancer2::Core::Error::throw() attempts to set the response using set_response(), but response is 'rw', not 'rwp'.
Error.pm - fix broken accessor
404 shouldn't display the requested path as part of the response HTML without escaping.
Member
|
My view is that including untrusted data in a template without escaping it is a failure of the template / template engine. I personally use a template engine which escapes by default so this issue does not affect me but this patch does since I use the message token in my 404. Time for me to look further... |
Member
|
So this only happens when Thoughts anyone? |
Member
|
@SysPete I agree with your gut feel. |
Contributor
|
@SysPete agreed. |
Member
xsawyerx
added a commit
that referenced
this pull request
Dec 16, 2015
xsawyerx
added a commit
that referenced
this pull request
Dec 16, 2015
[ DOCUMENTATION ]
* Update core team members and contributors list. (Russell Jenkins)
* GH #1066: Fix typo in Cookbook. (gertvanoss)
* Correct typo. It's "query_parameters", not "request_parameters".
Thanks to mst for letting me know and making sure I fix it!
(Sawyer X)
[ BUG FIXES ]
* GH #1040: Forward with a post body no longer tries to re-read body
filehandle. (Bas Bloemsaat)
* GH #1042: Add Diggest::SHA as explicit prequisite for installs on
perl < v5.9.3. (Russell Jenkins)
* GH #1071, #1070: HTML escape the message in the default error page.
(Peter Mottram)
* GH #1062, #1063: Command line interface didn't support
"-s SKELETON_DIRECTORY" in any order.
(Nuno Carvalho)
* GH #1052, #1053: Always call before_serializer hook when serializer
is set.
(Mickey Nasriachi)
* GH #1034: Correctly use different session cookie name for Dancer2.
(Jason A. Crome)
* GH #1060: Remove trailing slashes when providing skeleton
directory.
(Gabor Szabo)
[ ENHANCEMENTS ]
* Use Plack 1.0035 to make sure you only have HTTP::Headers::Fast
in the Plack::Request object internally.
* GH #951 #1037: Dancer2::Template::TemplateToolkit no longer sets TT2
INCLUDE_PATH directive, allowing `views` setting to be non-absolute
paths. (Russell Jenkins)
* GH #1032 #1043: Add .dancer file to new app scaffolding.
(Jason A. Crome)
* GH #1045: Small cleanups to Request class. (Russell Jenkins)
* GH #1033: strict && warnings in Dancer2::CLI. (Mohammad S Anwar)
* GH #1052, #1053: Allow before_serializer hook to change the content
using @_.
(Mickey Nasriachi)
* GH #1060: Ignore .git directory when using an external skeleton
directory.
(Gabor Szabo)
* GH #1060: Support more asset file extensions. (Gabor Szabo)
* GH #1072: Add request->is_options(). (Theo van Hoesel)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently, a request for a nonexistent path results in a 404 error that displays the requested path, without escaping.
So, if you request
you will see "crazy" in bold. This opens up HTML injection possibilities. This pull request simply removes the requested path from the information sent to the 404 template.