diff options
| author |   schwarze <schwarze@openbsd.org> | 2014-07-23 15:00:00 +0000 |
|---|---|---|
| committer | schwarze <schwarze@openbsd.org> | 2014-07-23 15:00:00 +0000 |
| commit | 71f7ad472f7967c3219230656a636c2ebbe25729 (patch) | |
| tree | e781e6f8fe375d2a6b35317e959ca9dcc3813bd0 /gnu/usr.bin/lynx/WWW/Library/Implementation/HTTP.c | |
| parent | document format changes, including the new @ts annotation that pkg_create (diff) | |
| download | wireguard-openbsd-71f7ad472f7967c3219230656a636c2ebbe25729.tar.xz wireguard-openbsd-71f7ad472f7967c3219230656a636c2ebbe25729.zip | |
Security fix:
After decoding numeric (\N) and one-character (\<, \> etc.)
character escape sequences, do not forget to HTML-encode the
resulting ASCII character. Malicious manuals were able to smuggle
XSS content by roff-escaping the HTML-special characters they need.
That's a classic bug type in many web applications, actually... :-(
Found myself while auditing the HTML formatter for safe output handling.
Diffstat (limited to 'gnu/usr.bin/lynx/WWW/Library/Implementation/HTTP.c')
0 files changed, 0 insertions, 0 deletions