cherokee / webserver

Cherokee Web Server
GNU General Public License v2.0
568 stars 104 forks source link

Use relative paths in the handler_server_info page #1228

Closed skinkie closed 5 years ago

skinkie commented 5 years ago

Issue #1227 describes a XSS vulnerability on the about page of cherokee-admin. While the report by LogicalTrust only describes a JavaScript variant, a CSS method could also be probed via logo.gif.

The root cause is the request being verbatim copied in to the HTML template. The request could be escaped, but leads to the question: Why are we presenting a full path, instead of a relative path to the page? This change removes the full path, and makes it relative. No URL is being printed in the template, and the XSS is avoided and therefore it should also be faster.