Fix cross-site scripting problem with user name display.

salilab · Sep 23, 2015 · baf25cd · baf25cd
1 parent d9e2d0e
commit baf25cd
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/perl/saliweb/frontend.pm b/perl/saliweb/frontend.pm
@@ -832,7 +832,7 @@ sub get_header {
                     "Logout");
         unshift @$navigation_links,
                 $q->a({-href=>"https://$web_server/scgi/server.cgi"},
-                      "Current User:$user_name");
+                      "Current User: " . $q->escapeHTML($user_name));
     } else {
         unshift @$navigation_links,
                 $q->a({-href=>"https://$web_server/scgi/server.cgi"},

diff --git a/test/frontend/frontend.pl b/test/frontend/frontend.pl
@@ -410,10 +410,10 @@ END
          'header with anonymous user');
 
     $self->{'user_info'} = 'foo';
-    $self->{'user_name'} = 'testuser';
+    $self->{'user_name'} = '<foo>testuser';
     like($self->get_header,
          '/<a href="https:\/\/modbase\.compbio\.ucsf\.edu\/scgi\/' .
-         'server\.cgi">Current User:testuser<\/a>.*' .
+         'server\.cgi">Current User: &lt;foo&gt;testuser<\/a>.*' .
          '<a href="https:\/\/modbase\.compbio\.ucsf\.edu\/scgi\/' .
          'server\.cgi\?logout=true">Logout<\/a>/s',
          '       with logged-in user');