Backups/OpenList
1
0
Fork 0
mirror of https://github.com/OpenListTeam/OpenList.git synced 2025-09-19 12:16:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): potential XSS vulnerabilities (#880)

Browse Source 
* fix(security): potential XSS vulnerabilities

* chore: replace alist identifier to openlist identifier

Co-authored-by: MadDogOwner <xiaoran@xrgzs.top>
Signed-off-by: ILoveScratch <ilovescratch@foxmail.com>

---------

Signed-off-by: ILoveScratch <ilovescratch@foxmail.com>
Co-authored-by: ILoveScratch <ilovescratch@foxmail.com>
Co-authored-by: MadDogOwner <xiaoran@xrgzs.top>
This commit is contained in:
hshpy
2025-07-29 20:17:11 +08:00
committed by GitHub
parent 239b58f63e
commit 11cf561307
1 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
server/handles/helper.go
View File

@ -2,6 +2,7 @@ package handles
import ( import (
"fmt" "fmt"
"html"
"net/url" "net/url"
"strings" "strings"
@ -43,27 +44,24 @@ func Plist(c *gin.Context) {
common.ErrorResp(c, err, 400) common.ErrorResp(c, err, 400)
return return
} }
fullName := c.Param("name")
Url := link.String()
Url = strings.ReplaceAll(Url, "<", "[")
Url = strings.ReplaceAll(Url, ">", "]")
nameEncode := linkNameSplit[1] nameEncode := linkNameSplit[1]
fullName, err = url.PathUnescape(nameEncode) fullName, err := url.PathUnescape(nameEncode)
if err != nil { if err != nil {
common.ErrorResp(c, err, 400) common.ErrorResp(c, err, 400)
return return
} }
name := fullName name := fullName
identifier := fmt.Sprintf("ci.nn.%s", url.PathEscape(fullName)) identifier := fmt.Sprintf("org.oplist.%s", fullName)
sep := "@" if strings.Contains(fullName, "@") {
if strings.Contains(fullName, sep) { ss := strings.Split(fullName, "@")
ss := strings.Split(fullName, sep) name = strings.Join(ss[:len(ss)-1], "@")
name = strings.Join(ss[:len(ss)-1], sep)
identifier = ss[len(ss)-1] identifier = ss[len(ss)-1]
} }
Url := link.String()
name = strings.ReplaceAll(name, "<", "[") Url = strings.ReplaceAll(Url, "<", "&lt;")
name = strings.ReplaceAll(name, ">", "]") Url = strings.ReplaceAll(Url, ">", "&gt;")
name = html.EscapeString(name)
identifier = html.EscapeString(identifier)
plist := fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> plist := fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"> <plist version="1.0">
<dict> <dict>