engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

files: prevent XSS in fake errors message on filenodes.

Browse source
This commit is contained in:
Marcin Kuzminski 2017-10-09 22:37:05 +02:00
parent 7b0f075487
commit c66d2e978e
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
rhodecode/apps/repository/views/repo_files.py
View file

@ -262,12 +262,14 @@ class RepoFilesView(RepoAppView):
commit_id, ext, fileformat, content_type = \
self._get_archive_spec(fname)
except ValueError:
return Response(_('Unknown archive type for: `{}`').format(fname))
return Response(_('Unknown archive type for: `{}`').format(
h.escape(fname)))
try:
commit = self.rhodecode_vcs_repo.get_commit(commit_id)
except CommitDoesNotExistError:
return Response(_('Unknown commit_id %s') % commit_id)
return Response(_('Unknown commit_id {}').format(
h.escape(commit_id)))
except EmptyRepositoryError:
return Response(_('Empty repository'))
@ -657,7 +659,7 @@ class RepoFilesView(RepoAppView):
try:
dir_node = commit.get_node(f_path)
except RepositoryError as e:
return Response('error: {}'.format(safe_str(e)))
return Response('error: {}'.format(h.escape(safe_str(e))))
if dir_node.is_file():
return Response('')