Fix security issue

airenas · Feb 19, 2021 · 5bcf866 · 5bcf866
1 parent 2d085bc
commit 5bcf866
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/internal/pkg/admin/service.go b/internal/pkg/admin/service.go
@@ -2,6 +2,7 @@ package admin
 
 import (
 	"encoding/json"
+	"html"
 	"log"
 	"net/http"
 	"strconv"
@@ -283,7 +284,7 @@ func validateProject(project string, prV PrValidator, w http.ResponseWriter) boo
 		return false
 	}
 	if !prV.Check(project) {
-		http.Error(w, "Wrong project "+project, http.StatusBadRequest)
+		http.Error(w, "Wrong project "+html.EscapeString(project), http.StatusBadRequest)
 		goapp.Log.Errorf("Wrong project %s", project)
 		return false
 	}