j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-11 12:46:49 +00:00
Code Issues Projects Releases Wiki Activity

fix(console): prevent DOM-based XSS in console views and escape JS strings

Browse source 
- Validate and coerce console query parameters (view_only, scale, resize_session, clip_viewport) to strict booleans via to_bool in console/views.py
- Sanitize view parameter to strictly 'lite' or 'full'
- Apply escapejs filter to all JS string interpolations in console-vnc-full.html, console-vnc-lite.html, console-spice-lite.html, and console-xterm.html
- Replace unsafe '| safe' filter in console-spice-lite.html with escapejs
- Add unit tests for XSS query param mitigation and escapejs character encoding
This commit is contained in:
catborise 2026-09-26 19:28:22 +03:00
parent 3d4accf1b4
commit f19c30840e
6 changed files with 102 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

6
console/templates/console-xterm.html
View file

@ -22,9 +22,9 @@
<script crossorigin="anonymous">
Terminal.applyAddon(fit);
let host = readQueryVariable('host', '{{ socketio_host }}');
let port = readQueryVariable('port', '{{ socketio_port }}');
let path = readQueryVariable('path', '{{ socketio_path }}');
let host = readQueryVariable('host', '{{ socketio_host|escapejs }}');
let port = readQueryVariable('port', '{{ socketio_port|escapejs }}');
let path = readQueryVariable('path', '{{ socketio_path|escapejs }}');
// Build the websocket URL used to connect