diff options
| author | rillig <rillig@NetBSD.org> | 2021-02-28 16:10:00 +0000 |
|---|---|---|
| committer | rillig <rillig@NetBSD.org> | 2021-02-28 16:10:00 +0000 |
| commit | d955cda006667044911d9d3a96da4304c98c1ebe (patch) | |
| tree | 780b97069c1a4fa9c63b17e92cc66fda91ac1334 /libexec/httpd/printenv.lua | |
| parent | 7f3e9bbc12731db9a64e39f5ebf404ce25789f7f (diff) | |
libexec/httpd: fix cross-site scripting in Lua example
curl \
--header 'NAME<x>: <y>' \
'http://127.0.0.1:8080/test/printenv?<b>=<i>'
Diffstat (limited to 'libexec/httpd/printenv.lua')
| -rw-r--r-- | libexec/httpd/printenv.lua | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/libexec/httpd/printenv.lua b/libexec/httpd/printenv.lua index 589e3095ee7..f41f3b2b84a 100644 --- a/libexec/httpd/printenv.lua +++ b/libexec/httpd/printenv.lua @@ -1,4 +1,4 @@ --- $NetBSD: printenv.lua,v 1.4 2020/08/25 20:02:33 leot Exp $ +-- $NetBSD: printenv.lua,v 1.5 2021/02/28 16:10:00 rillig Exp $ -- this small Lua script demonstrates the use of Lua in (bozo)httpd -- it will simply output the "environment" @@ -14,6 +14,10 @@ local httpd = require 'httpd' +function escape_html(s) + return s:gsub('&', '&'):gsub('<', '<'):gsub('>', '>'):gsub('"', '"') +end + function printenv(env, headers, query) -- we get the "environment" in the env table, the values are more @@ -40,18 +44,18 @@ function printenv(env, headers, query) httpd.print('<h2>Server Environment</h2>') -- print the list of "environment" variables for k, v in pairs(env) do - httpd.print(k .. '=' .. v .. '<br/>') + httpd.print(escape_html(k) .. '=' .. escape_html(v) .. '<br/>') end httpd.print('<h2>Request Headers</h2>') for k, v in pairs(headers) do - httpd.print(k .. '=' .. v .. '<br/>') + httpd.print(escape_html(k) .. '=' .. escape_html(v) .. '<br/>') end if query ~= nil then httpd.print('<h2>Query Variables</h2>') for k, v in pairs(query) do - httpd.print(k .. '=' .. v .. '<br/>') + httpd.print(escape_html(k) .. '=' .. escape_html(v) .. '<br/>') end end @@ -83,7 +87,7 @@ function form(env, header, query) end for k, v in pairs(query) do - httpd.print(k .. '=' .. v .. '<br/>') + httpd.print(escape_html(k) .. '=' .. escape_html(v) .. '<br/>') end else httpd.print('No values') |
