DOM text reinterpreted as HTML in static.js on lines 433 and 128 - Githubissues

certtools / intelmq-manager

IntelMQ Manager is a graphical interface to manage configurations for IntelMQ framework.

https://docs.intelmq.org/latest/user/manager/

102 stars 56 forks source link

DOM text reinterpreted as HTML in static.js on lines 433 and 128 #268

Closed ghost closed 3 years ago

ghost commented 3 years ago

GitHub's CodeQL detected two possible (medium-severity) security issues:

https://github.com/certtools/intelmq-manager/blob/92f726aa674620d354cb08b5d055ee38a7539d07/intelmq_manager/static/js/static.js#L433-L433 and https://github.com/certtools/intelmq-manager/blob/92f726aa674620d354cb08b5d055ee38a7539d07/intelmq_manager/static/js/static.js#L128-L128 Both with:

DOM text is reinterpreted as HTML without escaping meta-characters.

monoidic commented 3 years ago

Fixed by #270