Pro XSS

presto53 · Apr 29, 2015 · a695ff3 · a695ff3
1 parent be10761
commit a695ff3
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/Pro-Changes.md b/Pro-Changes.md
@@ -15,6 +15,8 @@ POOL2 = ConnectionPool.new { Redis.new(:url => "redis://localhost:6378/0") }
 mount Sidekiq::Pro::Web.with(redis_pool: POOL1) => '/sidekiq1'
 mount Sidekiq::Pro::Web.with(redis_pool: POOL2) => '/sidekiq2'
 ```
+- **SECURITY** Fix batch XSS in error data.  Thanks to moneybird.com for
+  reporting the issue.
 
 2.0.1
 -----------

diff --git a/lib/sidekiq/exception_handler.rb b/lib/sidekiq/exception_handler.rb
@@ -6,7 +6,7 @@ module ExceptionHandler
     class Logger
       def call(ex, ctxHash)
         Sidekiq.logger.warn(ctxHash) if !ctxHash.empty?
-        Sidekiq.logger.warn ex
+        Sidekiq.logger.warn "#{ex.class.name}: #{ex.message}"
         Sidekiq.logger.warn ex.backtrace.join("\n") unless ex.backtrace.nil?
       end