p2p/simulations: escape mockerType value from request (#24822)

Co-authored-by: Felix Lange <fjl@twurst.com>
ethereum · May 5, 2022 · ca8e2f1 · ca8e2f1
1 parent 256aae0
commit ca8e2f1
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/p2p/simulations/http.go b/p2p/simulations/http.go
@@ -22,6 +22,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"html"
 	"io"
 	"io/ioutil"
 	"net/http"
@@ -336,7 +337,7 @@ func (s *Server) StartMocker(w http.ResponseWriter, req *http.Request) {
 	mockerType := req.FormValue("mocker-type")
 	mockerFn := LookupMocker(mockerType)
 	if mockerFn == nil {
-		http.Error(w, fmt.Sprintf("unknown mocker type %q", mockerType), http.StatusBadRequest)
+		http.Error(w, fmt.Sprintf("unknown mocker type %q", html.EscapeString(mockerType)), http.StatusBadRequest)
 		return
 	}
 	nodeCount, err := strconv.Atoi(req.FormValue("node-count"))