mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
9c3a7cdbec
Four lookups built XPath expressions from values that come from requests (CodeQL py/xpath-injection, plus get_capabilities, which CodeQL did not flag; the pages are for superusers): - The architecture in the create wizard's URLs went into arch[@name='...'] in get_emulator, get_machine_types and get_capabilities: "nope' or '1'='1" matched every architecture. It is now an XPath variable ($arch), which is never parsed as XPath. - Network filter rules were found with a predicate built from the posted action, direction and priority: a quote raised SyntaxError (an error page). The rule is now found by comparing its attributes. - unset_qos put the posted direction into the path, so "*" removed every bandwidth setting. It accepts inbound and outbound, as set_qos does; the network page shows an error for anything else. No other XPath in vrtManager is built from a value; the remaining expressions are constants. The tests fail on the previous code. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| connection.py | ||
| create.py | ||
| hostdetails.py | ||
| instance.py | ||
| interface.py | ||
| libvirt-ssh | ||
| network.py | ||
| nwfilters.py | ||
| rwlock.py | ||
| storage.py | ||
| test_change_network.py | ||
| test_connection.py | ||
| test_console_setters.py | ||
| test_iso_media.py | ||
| test_live_connection.py | ||
| test_network_ip.py | ||
| test_persistent_edits.py | ||
| test_read_cache.py | ||
| test_resize_disk.py | ||
| test_rwlock.py | ||
| test_usage.py | ||
| test_util.py | ||
| test_xml_safety.py | ||
| test_xpath_values.py | ||
| util.py | ||
| virtsecrets.py | ||