From 72946e11135e250ad24d32a2a06fb1698158e33a Mon Sep 17 00:00:00 2001 From: Lan Tian Date: Sun, 17 Jan 2021 01:14:49 +0800 Subject: [PATCH] frontend: filter output to prevent XSS --- frontend/bgpmap.go | 5 +++-- frontend/bindata/templates/bgpmap.tpl | 6 ++++-- frontend/bindata/templates/page.tpl | 12 ++++++------ frontend/bindata/templates/summary.tpl | 12 ++++++------ frontend/render.go | 4 +++- frontend/webserver.go | 4 ++-- 6 files changed, 24 insertions(+), 19 deletions(-) diff --git a/frontend/bgpmap.go b/frontend/bgpmap.go index add7697..203cd0c 100644 --- a/frontend/bgpmap.go +++ b/frontend/bgpmap.go @@ -2,6 +2,7 @@ package main import ( "fmt" + "html" "net" "strings" ) @@ -24,7 +25,7 @@ func birdRouteToGraphviz(servers []string, responses []string, target string) st graph := make(map[string]string) // Helper to add an edge addEdge := func(src string, dest string, attr string) { - key := "\"" + src + "\" -> \"" + dest + "\"" + key := "\"" + html.EscapeString(src) + "\" -> \"" + html.EscapeString(dest) + "\"" _, present := graph[key] // Do not remove edge's attributes if it's already present if present && len(attr) == 0 { @@ -34,7 +35,7 @@ func birdRouteToGraphviz(servers []string, responses []string, target string) st } // Helper to set attribute for a point in graph addPoint := func(name string, attr string) { - key := "\"" + name + "\"" + key := "\"" + html.EscapeString(name) + "\"" _, present := graph[key] // Do not remove point's attributes if it's already present if present && len(attr) == 0 { diff --git a/frontend/bindata/templates/bgpmap.tpl b/frontend/bindata/templates/bgpmap.tpl index 89b6aa6..24ca52c 100644 --- a/frontend/bindata/templates/bgpmap.tpl +++ b/frontend/bindata/templates/bgpmap.tpl @@ -1,4 +1,6 @@

BGPmap: {{ html .Target }}

+
+
@@ -6,9 +8,9 @@ var viz = new Viz(); viz.renderSVGElement(`{{ .Result }}`) .then(element => { - document.body.appendChild(element); + document.getElementById("bgpmap").appendChild(element); }) .catch(error => { - document.body.innerHTML = "
"+error+"
" + document.getElementById("bgpmap").innerHTML = "
"+error+"
" }); diff --git a/frontend/bindata/templates/page.tpl b/frontend/bindata/templates/page.tpl index 5c50a02..017b51c 100644 --- a/frontend/bindata/templates/page.tpl +++ b/frontend/bindata/templates/page.tpl @@ -5,7 +5,7 @@ -{{ .Title }} +{{ html .Title }} @@ -29,12 +29,12 @@ @@ -45,11 +45,11 @@
- - + +
diff --git a/frontend/bindata/templates/summary.tpl b/frontend/bindata/templates/summary.tpl index eb72128..cd06d20 100644 --- a/frontend/bindata/templates/summary.tpl +++ b/frontend/bindata/templates/summary.tpl @@ -9,12 +9,12 @@ {{ range .Rows }} - {{ html .Name }} - {{ .Proto }} - {{ .Table }} - {{ .State }} - {{ .Since }} - {{ .Info }} + {{ html .Name }} + {{ html .Proto }} + {{ html .Table }} + {{ html .State }} + {{ html .Since }} + {{ html .Info }} {{ end }} diff --git a/frontend/render.go b/frontend/render.go index 2b9da29..899fd6a 100644 --- a/frontend/render.go +++ b/frontend/render.go @@ -7,6 +7,7 @@ import ( "regexp" "sort" "strings" + "text/template" ) // static options map @@ -81,6 +82,7 @@ func renderPageTemplate(w http.ResponseWriter, r *http.Request, title string, co func smartFormatter(s string) string { var result string result += "
"
+	s = template.HTMLEscapeString(s)
 	for _, line := range strings.Split(s, "\n") {
 		var lineFormatted string
 		if strings.HasPrefix(strings.TrimSpace(line), "BGP.as_path:") || strings.HasPrefix(strings.TrimSpace(line), "Neighbor AS:") || strings.HasPrefix(strings.TrimSpace(line), "Local AS:") {
@@ -103,7 +105,7 @@ func summaryTable(data string, serverName string) string {
 	lines := strings.Split(strings.TrimSpace(data), "\n")
 	if len(lines) <= 1 {
 		// Likely backend returned an error message
-		return "
" + strings.TrimSpace(data) + "
"
+		return "
" + template.HTMLEscapeString(strings.TrimSpace(data)) + "
"
 	}
 
 	args := TemplateSummary{
diff --git a/frontend/webserver.go b/frontend/webserver.go
index 71ac742..9dc36a9 100644
--- a/frontend/webserver.go
+++ b/frontend/webserver.go
@@ -9,7 +9,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/elazarl/go-bindata-assetfs"
+	assetfs "github.com/elazarl/go-bindata-assetfs"
 	"github.com/gorilla/handlers"
 )
 
@@ -124,7 +124,7 @@ func webBackendCommunicator(endpoint string, command string) func(w http.Respons
 
 		renderPageTemplate(
 			w, r,
-			" - "+html.EscapeString(endpoint+" "+backendCommand),
+			" - "+endpoint+" "+backendCommand,
 			content,
 		)
 	}