Skip to content

Commit

Permalink
fix(security): remove unnecessary localization logic
Browse files Browse the repository at this point in the history
Removed unnecessary localization logic that dynamically set the locale based on request parameters to mitigate a XSS vulnerability. Since our system does not support multiple languages, replaced it with a static default locale of `en`.
  • Loading branch information
MDeLuise authored and Coduz committed May 16, 2024
1 parent 9a60262 commit b038951
Showing 1 changed file with 1 addition and 8 deletions.
9 changes: 1 addition & 8 deletions console/web/src/main/webapp/console.jsp
Original file line number Diff line number Diff line change
Expand Up @@ -32,14 +32,7 @@
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=9">

<!-- Manage the localization of the console -->
<% if (request.getParameter("l") != null) { %>
<meta name="gwt:property" content="locale=<%=request.getParameter("l")%>">
<% } else if (request.getHeader("Accept-Language") != null) { %>
<meta name="gwt:property" content="locale=<%=request.getHeader("Accept-Language").split(",")[0]%>">
<% } else { %>
<meta name="gwt:property" content="locale=en">
<% } %>
<meta name="gwt:property" content="locale=en">

<!--
Favicon and title definition
Expand Down

0 comments on commit b038951

Please sign in to comment.