summaryrefslogtreecommitdiff
path: root/libexec/httpd/printenv.lua
diff options
context:
space:
mode:
authorrillig <rillig@NetBSD.org>2021-02-28 16:10:00 +0000
committerrillig <rillig@NetBSD.org>2021-02-28 16:10:00 +0000
commitd955cda006667044911d9d3a96da4304c98c1ebe (patch)
tree780b97069c1a4fa9c63b17e92cc66fda91ac1334 /libexec/httpd/printenv.lua
parent7f3e9bbc12731db9a64e39f5ebf404ce25789f7f (diff)
libexec/httpd: fix cross-site scripting in Lua example
curl \ --header 'NAME<x>: <y>' \ 'http://127.0.0.1:8080/test/printenv?<b>=<i>'
Diffstat (limited to 'libexec/httpd/printenv.lua')
-rw-r--r--libexec/httpd/printenv.lua14
1 files changed, 9 insertions, 5 deletions
diff --git a/libexec/httpd/printenv.lua b/libexec/httpd/printenv.lua
index 589e3095ee7..f41f3b2b84a 100644
--- a/libexec/httpd/printenv.lua
+++ b/libexec/httpd/printenv.lua
@@ -1,4 +1,4 @@
--- $NetBSD: printenv.lua,v 1.4 2020/08/25 20:02:33 leot Exp $
+-- $NetBSD: printenv.lua,v 1.5 2021/02/28 16:10:00 rillig Exp $
-- this small Lua script demonstrates the use of Lua in (bozo)httpd
-- it will simply output the "environment"
@@ -14,6 +14,10 @@
local httpd = require 'httpd'
+function escape_html(s)
+ return s:gsub('&', '&amp;'):gsub('<', '&lt;'):gsub('>', '&gt;'):gsub('"', '&quot;')
+end
+
function printenv(env, headers, query)
-- we get the "environment" in the env table, the values are more
@@ -40,18 +44,18 @@ function printenv(env, headers, query)
httpd.print('<h2>Server Environment</h2>')
-- print the list of "environment" variables
for k, v in pairs(env) do
- httpd.print(k .. '=' .. v .. '<br/>')
+ httpd.print(escape_html(k) .. '=' .. escape_html(v) .. '<br/>')
end
httpd.print('<h2>Request Headers</h2>')
for k, v in pairs(headers) do
- httpd.print(k .. '=' .. v .. '<br/>')
+ httpd.print(escape_html(k) .. '=' .. escape_html(v) .. '<br/>')
end
if query ~= nil then
httpd.print('<h2>Query Variables</h2>')
for k, v in pairs(query) do
- httpd.print(k .. '=' .. v .. '<br/>')
+ httpd.print(escape_html(k) .. '=' .. escape_html(v) .. '<br/>')
end
end
@@ -83,7 +87,7 @@ function form(env, header, query)
end
for k, v in pairs(query) do
- httpd.print(k .. '=' .. v .. '<br/>')
+ httpd.print(escape_html(k) .. '=' .. escape_html(v) .. '<br/>')
end
else
httpd.print('No values')