Backups/OpenList
1
0
Fork 0
mirror of https://github.com/OpenListTeam/OpenList.git synced 2025-09-19 04:06:18 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): potential XSS vulnerabilities (#880)

Browse Source 
* fix(security): potential XSS vulnerabilities

* chore: replace alist identifier to openlist identifier

Co-authored-by: MadDogOwner <xiaoran@xrgzs.top>
Signed-off-by: ILoveScratch <ilovescratch@foxmail.com>

---------

Signed-off-by: ILoveScratch <ilovescratch@foxmail.com>
Co-authored-by: ILoveScratch <ilovescratch@foxmail.com>
Co-authored-by: MadDogOwner <xiaoran@xrgzs.top>
This commit is contained in:
hshpy
2025-07-29 20:17:11 +08:00
committed by GitHub
parent 239b58f63e
commit 11cf561307
1 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
server/handles/helper.go
View File

@ -2,6 +2,7 @@ package handles
import (
"fmt"
"html"
"net/url"
"strings"
@ -43,27 +44,24 @@ func Plist(c *gin.Context) {
common.ErrorResp(c, err, 400)
return
}
fullName := c.Param("name")
Url := link.String()
Url = strings.ReplaceAll(Url, "<", "[")
Url = strings.ReplaceAll(Url, ">", "]")
nameEncode := linkNameSplit[1]
fullName, err = url.PathUnescape(nameEncode)
fullName, err := url.PathUnescape(nameEncode)
if err != nil {
common.ErrorResp(c, err, 400)
return
}
name := fullName
identifier := fmt.Sprintf("ci.nn.%s", url.PathEscape(fullName))
sep := "@"
if strings.Contains(fullName, sep) {
ss := strings.Split(fullName, sep)
name = strings.Join(ss[:len(ss)-1], sep)
identifier := fmt.Sprintf("org.oplist.%s", fullName)
if strings.Contains(fullName, "@") {
ss := strings.Split(fullName, "@")
name = strings.Join(ss[:len(ss)-1], "@")
identifier = ss[len(ss)-1]
}
name = strings.ReplaceAll(name, "<", "[")
name = strings.ReplaceAll(name, ">", "]")
Url := link.String()
Url = strings.ReplaceAll(Url, "<", "&lt;")
Url = strings.ReplaceAll(Url, ">", "&gt;")
name = html.EscapeString(name)
identifier = html.EscapeString(identifier)
plist := fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>