kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2026-07-22 22:44:58 -07:00
Code Issues Packages Projects Releases Wiki Activity

http: Escape error page text to prevent reflected XSS

Browse Source 
The text parameter in ast_http_create_response() is inserted into
the HTML body without escaping, while the server name on the same
page is properly escaped via ast_xml_escape(). When res_phoneprov
passes the decoded request URI as the text of a 404 response, HTML
metacharacters in the URI are rendered by the browser.

Apply ast_xml_escape() to the text parameter before inserting it
into the HTML template, using the same function already used for
the server name.

Resolves: #GHSA-4pgv-j3mr-3rcp
This commit is contained in:
Milan Kyselica
2026-04-08 20:02:19 +02:00
committed by George Joseph
parent e8c9782fb3
commit a846b9a012
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
main/http.c
+9 -1
View File
@@ -634,6 +634,7 @@ void ast_http_create_response(struct ast_tcptls_session_instance *ser, int statu
const char *status_title, struct ast_str *http_header_data, const char *text)
{
char server_name[MAX_SERVER_NAME_LENGTH];
char escaped_text[512];
struct ast_str *server_address = ast_str_create(MAX_SERVER_NAME_LENGTH);
struct ast_str *out = ast_str_create(INITIAL_RESPONSE_BODY_BUFFER);
@@ -656,6 +657,13 @@ void ast_http_create_response(struct ast_tcptls_session_instance *ser, int statu
server_name);
}
/* Escape text to prevent reflected XSS in error pages */
if (!ast_strlen_zero(text)) {
ast_xml_escape(text, escaped_text, sizeof(escaped_text));
} else {
escaped_text[0] = '\0';
}
ast_str_set(&out,
0,
"<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\r\n"
@@ -670,7 +678,7 @@ void ast_http_create_response(struct ast_tcptls_session_instance *ser, int statu
status_code,
status_title,
status_title,
text ? text : "",
escaped_text,
ast_str_buffer(server_address));
ast_free(server_address);