search

todbot / blink1-tool

Command-line tools and C library for blink(1) USB RGB LED
https://blink1.thingm.com/
Other
84 stars 15 forks source link

blink1-tiny-server doesn't return any response when html is disabled and an invalid url is requested #72

Open normanr opened 5 months ago

normanr commented 5 months ago

If blink1-tiny-server is started with --no-html and an unrecognized uri is requested (eg: /404), then the requests is never completed.

Note that echoing the requested uri back to the client (like was done before version 2.3.0) could open up an XSS, so either don't echo the uri back in the response, or ensure that it is appropriately encoded and that correct http response header (Content-type: application/json? X-Content-Type-Options: nosniff?) is set to ensure that browsers interpret the response as json.

todbot commented 5 months ago

Thanks! These are great suggestions