Fix possible Cross-site Scripting (XSS) in Rest/GraphQL viewer

Cockpit-HQ · Aug 19, 2023 · 2a93d39 · 2a93d39
1 parent ddc7881
commit 2a93d39
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 7 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,7 @@
 ## WIP
 
 - Fix mime type detection on asset upload
+- Fix possible Cross-site Scripting (XSS) in Rest/GraphQL viewer
 
 ## 2.6.3 (2023-08-15)
 

diff --git a/modules/System/views/api/graphql-viewer.php b/modules/System/views/api/graphql-viewer.php
@@ -112,7 +112,7 @@ function graphQLFetcher(graphQLParams) {
 
   </script>
 
-  <input id="apiKey" type="text" placeholder="API Key" value="<?=($apiKey ? $apiKey : '')?>">
+  <input id="apiKey" type="text" placeholder="API Key" value="<?=$this->escape($apiKey ? $apiKey : '')?>">
 
 <style>
 
@@ -223,7 +223,7 @@ function graphQLFetcher(graphQLParams) {
   background: #10131a;
   border: 1px solid <?=($primaryColor ? $primaryColor : '#0e8fff')?>;
   box-shadow: none !important;
-  fill: <?=($primaryColor ? $primaryColor : '#0e8fff')?>;
+  fill: <?= $this->escape($primaryColor ? $primaryColor : '#0e8fff')?>;
 }
 
 .graphiql-container .history-contents p {

diff --git a/modules/System/views/api/rest-api-viewer.php b/modules/System/views/api/rest-api-viewer.php
@@ -5,7 +5,7 @@
 </head>
 <body>
     <rapi-doc
-        spec-url="<?=$openApiUrl?>"
+        spec-url="<?=$this->escape($openApiUrl)?>"
         show-header="false"
         show-info="false"
         render-style="read"
@@ -14,12 +14,12 @@
         <?php if($apiKey): ?>
         api-key-name = "api-key"
         api-key-location = "header"
-        api-key-value = "<?=$apiKey?>"
+        api-key-value = "<?=$this->escape($apiKey)?>"
         <?php endif ?>
 
-        bg-color="<?=($bgColor ? $bgColor : '#10131a')?>"
-        text-color="<?=($textColor ? $textColor : '#fafafa')?>"
-        primary-color="<?=($primaryColor ? $primaryColor : '#0e8fff')?>"
+        bg-color="<?=$this->escape($bgColor ? $bgColor : '#10131a')?>"
+        text-color="<?= $this->escape($textColor ? $textColor : '#fafafa')?>"
+        primary-color="<?= $this->escape($primaryColor ? $primaryColor : '#0e8fff')?>"
     ></rapi-doc>
 
     <script type="module" src="<?=$this->base('system:assets/vendor/rapidoc.js')?>"></script>