Security
This release fixes a critical stored XSS in the Sonar dashboard (GHSA-9vgp-2j2c-w2mx).
Captured SQL query text (and dumps) were rendered with Django's |safe filter. An unauthenticated attacker could inject HTML/JavaScript via request parameters that end up in logged SQL; when a superuser later opened the query in the dashboard, the payload executed in their session.
All users of django-sonar ≤ 0.5.1 should upgrade immediately, especially if the middleware is enabled in production.
Also hardened: GET /sonar/clear/ no longer deletes data; clearing now requires POST with CSRF.
Thanks to @EQSTLab for the report.
Fixed
- Escape SQL and dump content in query detail, request detail queries, and dumps list templates
- Clear-all action is POST-only
Upgrade
pip install -U django-sonar==0.5.2