search

G4lile0 / tinyGS

📡 Open Ground Station Network 🛰
GNU General Public License v3.0
922 stars 175 forks source link

WiFi neworks with a ' in the name cause funny behavior in the Dashboard Config #168

Closed H3wastooshort closed 1 year ago

H3wastooshort commented 2 years ago

When using a WiFi network with a ' in it's name, it will be cut off at the ' in the Dashboard Config. It is still saved properly and connects fine, but every time when you go to the Configuration Dashboard on the GS's IP, you will have to type out the part after the ' again as only the part before will be auto-completed into the WiFi SSID field. Arvid's IoT becomes Arvid.

This is because the String is not properly escaped when pasting it into the HTML.

<div class=''><label for='iwcWifiSsid'>WiFi SSID</label><input type='text' id='iwcWifiSsid' name='iwcWifiSsid' 32 placeholder='' value='Arvid's IoT' /><div class='em'></div></div>

You can clearly see the ' being the same as the staet and end quotes. If i were to set my network to ' /> <h1>trololol</h1> <img alt=' it would even show something funny on the UI. This is not really a security problem imo because you would have to enter it into the UI first but could cause confusion with networks using the ' character.

4m1g0 commented 1 year ago

Thanks for the report, unfortunatelly this is handled by the configuration library we are using. We plan to change this library in the future so, unless there is a security flaw, this will be fixed with the new library.