Skip to content

Commit

Permalink
Don't echo back the provided path on a 404 error
Browse files Browse the repository at this point in the history
This gets flagged up by security scans a potential cross-site scripting vector - I suspect that this would be quite difficult to exploit for real, but I'm making this fix because it removes spurious XSS warnings on scans but doesn't affect useful function.
  • Loading branch information
rkday committed Jun 14, 2021
1 parent 5bc4c6b commit a6d9cbc
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion lib/fluent/plugin_helper/http_server/router.rb
Expand Up @@ -22,7 +22,7 @@ module HttpServer
class Router
class NotFoundApp
def self.call(req)
[404, { 'Content-Type' => 'text/plain' }, "404 Not Found: #{req.path}\n"]
[404, { 'Content-Type' => 'text/plain' }, "404 Not Found\n"]
end
end

Expand Down

0 comments on commit a6d9cbc

Please sign in to comment.