Fixes #525

owtf · Jan 22, 2016 · 1fe7941 · 1fe7941
1 parent 1e473d0
commit 1fe7941
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 4 deletions.
diff --git a/framework/interface/custom_handlers.py b/framework/interface/custom_handlers.py
@@ -61,13 +61,13 @@ def get(self, path, include_body=True):
                         {% if len(dirnames) > 0 %}
                             <h2>Directories</h2>
                             {% for item in dirnames %}
-                                <li><a href="{{ item }}/">{{ item }}/</a></li>
+                                <li><a href="{{ url_escape(item, plus=False) }}/">{{ item }}/</a></li>
                             {% end %}
                         {% end %}
                         {% if len(filenames) > 0 %}
                             <h2>Files</h2>
                             {% for item in filenames %}
-                                <li><a href="{{ item }}">{{ item }}</a></li>
+                                <li><a href="{{ url_escape(item, plus=False) }}">{{ item }}</a></li>
                             {% end %}
                         {% end %}
                     </ul>

diff --git a/framework/interface/templates/plugin_report.html b/framework/interface/templates/plugin_report.html
@@ -94,7 +94,7 @@ <h4 id="header_badge_{{ test_code }}"></h4>
                                         <td> {{ poutput['start_time'] }} <br />{{ poutput['end_time'] }} </td>
                                         <td> {{ poutput['status'] }} </td>
                                         {% if poutput['output_path'] %}
-                                            <td><a href="/output_files/{{ poutput['output_path'] }}/" target="_blank" class="btn btn-primary">Browse</a></td>
+                                            <td><a href="/output_files/{{ url_escape(poutput['output_path'], plus=True) }}/" target="_blank" class="btn btn-primary">Browse</a></td>
                                         {% end %}
                                         <td>
                                             <div class="btn-group">

diff --git a/framework/interface/ui_handlers.py b/framework/interface/ui_handlers.py
@@ -1,6 +1,7 @@
 import os
 import collections
 import tornado.web
+from tornado.escape import url_escape
 import uuid
 from framework.dependency_management.dependency_resolver import ServiceLocator
 from framework.lib.exceptions import InvalidTargetReference, \
@@ -446,5 +447,5 @@ def get(self, file_url):
             self.request.host.replace(
                 config.FrameworkConfigGet("UI_SERVER_PORT"),
                 config.FrameworkConfigGet("FILE_SERVER_PORT")))
-        redirect_file_url = output_files_server + file_url
+        redirect_file_url = output_files_server + url_escape(file_url, plus=False)
         self.redirect(redirect_file_url, permanent=True)