Fix header url param to not render html to resolve XSS #346
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #345
http://localhost:2222/ssh/host/mydevice.local?header=<img src=x onerror=alert('XSS')>
Before:
![image](https://private-user-images.githubusercontent.com/2525601/278209925-ab3ad052-30c3-4fd9-93c4-3581cac57d6d.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQzMjQyMzcsIm5iZiI6MTcyNDMyMzkzNywicGF0aCI6Ii8yNTI1NjAxLzI3ODIwOTkyNS1hYjNhZDA1Mi0zMGMzLTRmZDktOTNjNC0zNTgxY2FjNTdkNmQucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDgyMiUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA4MjJUMTA1MjE3WiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9OTc2OGI0M2I1NmI1M2U0YTQwNjU3MTM5NTIyZTI4YjFkZTYxOTY2YWM4NmZmYjY2MzM4MDEwNWIzODMzOTBiMSZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.-adlrpjPiys04UB2cjTjQOtzaLWDE27Sq3DfMLW7ZJk)
After:
![image](https://private-user-images.githubusercontent.com/2525601/278209983-20b6f2e6-5d25-48bf-836c-44a3a00da80b.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQzMjQyMzcsIm5iZiI6MTcyNDMyMzkzNywicGF0aCI6Ii8yNTI1NjAxLzI3ODIwOTk4My0yMGI2ZjJlNi01ZDI1LTQ4YmYtODM2Yy00NGEzYTAwZGE4MGIucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDgyMiUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA4MjJUMTA1MjE3WiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9YzlkOTlmMDhkNDE4OWMzZjM3YmU5OWEyNjA4YWY5N2Q2MWNjNjg5OGI3OTMxZTgxODIzODgzYzljNzc2Nzk4MyZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.SH3y20gWCGCu4NajJh1aIROHZTB4fLIPQN1ArAJ66DI)
Note - This could be breaking if someone is using the header for HTML rendering, however, i would say this is still justified.