HTML-escape error messages (OVE-20160505-0012)

The instance in cgierror() is a potential cross-site scripting attack,
because an attacker could conceivably cause some module to raise an
exception that includes attacker-supplied HTML in its message, for
example via a crafted filename. (OVE-20160505-0012)

The instances in preprocess() is just correctness. It is not a
cross-site scripting attack, because an attacker could equally well
write the desired HTML themselves; the sanitize hook is what
protects us from cross-site scripting here.

diff --git a/IkiWiki.pm b/IkiWiki.pm
index 1043ef4024ba5994d773b524103c46baad50b084..b55078af0772cbc52150392a8e13e8aa8b5158da 100644 (file)
--- a/IkiWiki.pm
+++ b/IkiWiki.pm
@@ -1570,6 +1570,8 @@ sub preprocess ($$$;$$) {
                                if ($@) {
                                        my $error=$@;
                                        chomp $error;
+                                       eval q{use HTML::Entities};
+                                       $error = encode_entities($error);
                                        $ret="[[!$command <span class=\"error\">".
                                                gettext("Error").": $error"."</span>]]";
                                }

diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index f448db6ef8a213fa84d57f72ad236569c510d304..a6c0c271258b2f9dca1692c89ae3ce6b5d20631e 100644 (file)
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -491,6 +491,9 @@ sub cgi (;$$) {
 sub cgierror ($) {
        my $message=shift;
 
+       eval q{use HTML::Entities};
+       $message = encode_entities($message);
+
        print "Content-type: text/html\n\n";
        print cgitemplate(undef, gettext("Error"),
                "<p class=\"error\">".gettext("Error").": $message</p>");