Stored XSS when deleting proxy host

[l4rm4nd]

Steps to reproduce:

1. Login as administrative user
2. Create a new proxy host entry with the payload <script>alert('XSS')</script>.google.com as domain
3. Hit save
4. Try to delete the newly added proxy host. XSS payload is executed.

Recommendation:

Implementing input validation and/or ensuring output sanitization as done for all other inputs/outputs.

Risk:

Low risk since high privileges are required.

[l4rm4nd]

Also works for redirection hosts with XSS domain payloads. If a redirection host is deleted, XSS payload is executed.

[jc21]

Thanks for the pickup.

Fixed in develop branch and will be out with the next release.