Fixes an XSS issue with unescaped node names. #3578
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
michaelw
pushed a commit
to michaelw/consul
that referenced
this pull request
Jan 11, 2018
Version 1.0.0 * tag 'v1.0.0': (455 commits) Release v1.0.0 Puts the tree in 1.0 final release mode. Fixes an XSS issue with unescaped node names. (hashicorp#3578) Adds a note about the Raft protocol not being the same as the Consul protocol. Adds a 1.0 section to the upgrade guide and cleans up the change log. Update sentinel.html.markdown.erb Update dns forwarding documentation (hashicorp#3574) Adds a brief wait and poll period to update check status after a timeout. (hashicorp#3573) Cleans up some drift between the OSS and Enterprise trees. Clarify the docs around script check timeout behavior Updates the change log. Kill check processes after the timeout is reached (hashicorp#3567) Updates the change log. retry locks on network errors (hashicorp#3553) Fix example code formatting in godoc config: remove redundant code config: fix check for segment.port <= 0 and add test Adds check to make sure port is given so we avoid a nil bind address. Removes obsolete segment stub. agent: add option to discard health output (hashicorp#3562) ...
johncowen
pushed a commit
that referenced
this pull request
May 4, 2018
* Fixes an XSS issue with node names in the tomography graph. * Updates built-in static web assets. * Updates the change log.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This fixes an XSS issue with unescaped node names in the coordinate display. We also escape the segment name for good measure, though the format of those is tightly controlled by Consul, so those were't vulnerable due to back end validation.