From 167af6594322362226de39711a8385b385a991e5 Mon Sep 17 00:00:00 2001 From: Jon Seager Date: Fri, 13 Feb 2026 13:05:44 +0000 Subject: [PATCH] fix: prevent XSS in redirect script via JSON encoding JSON-encode the URL in render_redirect_script instead of interpolating it into a single-quoted string, preventing injection via crafted URLs. --- src/application/routes/support.rs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/application/routes/support.rs b/src/application/routes/support.rs index 17c2169..8c620a7 100644 --- a/src/application/routes/support.rs +++ b/src/application/routes/support.rs @@ -178,8 +178,11 @@ where /// Return a Datastar response that redirects the browser to `url`. /// /// Works by appending a `"); + let encoded_url = serde_json::to_string(url) + .map_err(|err| AppError::unexpected(format!("failed to encode redirect URL: {err}")))?; + let script = format!(""); let mut response = Html(script).into_response(); response .headers_mut()