Prevent malformed DNS queries executing JS on querylog/long term quer…

…y log Signed-off-by: Adam Warner <me@adamwarner.co.uk>
pi-hole · Dec 23, 2020 · c568d05 · c568d05
1 parent c32bcd3
commit c568d05
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 4 deletions.
diff --git a/scripts/pi-hole/js/db_queries.js b/scripts/pi-hole/js/db_queries.js
@@ -194,6 +194,10 @@ $(function () {
 
   tableApi = $("#all-queries").DataTable({
     rowCallback: function (row, data) {
+      for (i = 0; i < data.length; i++) {
+        //Santise data coming back from API to ensure no malicious HTML
+        data[i] = utils.escapeHtml(data[i]);
+      }
       var fieldtext, buttontext, color;
       switch (data[4]) {
         case 1:
@@ -324,8 +328,8 @@ $(function () {
         }
       },
       { width: "10%" },
-      { width: "40%" },
-      { width: "20%", type: "ip-address" },
+      { width: "40%", render: $.fn.dataTable.render.text() },
+      { width: "20%", type: "ip-address", render: $.fn.dataTable.render.text() },
       { width: "10%" },
       { width: "5%" }
     ],

diff --git a/scripts/pi-hole/js/queries.js b/scripts/pi-hole/js/queries.js
@@ -74,6 +74,10 @@ $(function () {
 
   tableApi = $("#all-queries").DataTable({
     rowCallback: function (row, data) {
+      for (i = 0; i < data.length; i++) {
+        //Santise data coming back from API to ensure no malicious HTML
+        data[i] = utils.escapeHtml(data[i]);
+      }
       // DNSSEC status
       var dnssecStatus;
       switch (data[6]) {

diff --git a/scripts/pi-hole/js/utils.js b/scripts/pi-hole/js/utils.js
@@ -16,7 +16,7 @@ function escapeHtml(text) {
     '"': "&quot;",
     "'": "&#039;"
   };
-
+  if (typeof text !== "string") return text;
   if (text === null) return null;
 
   return text.replace(/[&<>"']/g, function (m) {
@@ -32,7 +32,7 @@ function unescapeHtml(text) {
     "&quot;": '"',
     "&#039;": "'"
   };
-
+  if (typeof text !== "string") return text;
   if (text === null) return null;
 
   return text.replace(/&(?:amp|lt|gt|quot|#039);/g, function (m) {