Fixes #101: Add escape for CVE-2017-12097

ejschmitt · Mar 6, 2018 · 6bcb10e · 6bcb10e
1 parent 2c55f1f
commit 6bcb10e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/delayed_job_web/application/app.rb b/lib/delayed_job_web/application/app.rb
@@ -45,7 +45,7 @@ def per_page
 
   def url_path(*path_parts)
     url = [ path_prefix, path_parts ].join("/").squeeze('/')
-    url += "?queues=#{@queues.join(",")}" unless @queues.empty?
+    url += "?queues=#{CGI.escape(@queues.join(","))}" unless @queues.empty?
     url
   end