search

certtools / intelmq-manager

IntelMQ Manager is a graphical interface to manage configurations for IntelMQ framework.
https://docs.intelmq.org/latest/user/manager/
102 stars 56 forks source link

Incomplete string escaping or encoding in monitor.js Line 547 #267

Closed ghost closed 3 years ago

ghost commented 3 years ago

GitHub's CodeQL detected a potential security issue in https://github.com/certtools/intelmq-manager/blob/588c6773b6c83e3b761547463e05c08cbd814128/intelmq_manager/static/js/monitor.js#L547-L547

This replaces only the first occurrence of "'".

Previously the line looked like this and had the same issue: https://github.com/certtools/intelmq-manager/blob/7b65cdcfd44236f0259e3f9c803b6254cc892dea/intelmq_manager/static/js/monitor.js#L548-L548

I did not check if the claim is true.

monoidic commented 3 years ago

Fixed by #270