moby/brewlog
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: prevent XSS in redirect script via JSON encoding

Browse source 
JSON-encode the URL in render_redirect_script instead of interpolating
it into a single-quoted string, preventing injection via crafted URLs.
This commit is contained in:
Jon Seager 2026-02-13 13:05:44 +00:00
parent ff2c602139
commit 167af65943
No known key found for this signature in database
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/application/routes/support.rs
View file

@ -178,8 +178,11 @@ where
/// Return a Datastar response that redirects the browser to `url`. /// Return a Datastar response that redirects the browser to `url`.
/// ///
/// Works by appending a `<script>` tag to `<body>` that sets `window.location.href`. /// Works by appending a `<script>` tag to `<body>` that sets `window.location.href`.
/// The URL is JSON-encoded to prevent XSS via crafted URLs.
pub fn render_redirect_script(url: &str) -> Result<Response, AppError> { pub fn render_redirect_script(url: &str) -> Result<Response, AppError> {
let script = format!("<script>window.location.href='{url}'</script>"); let encoded_url = serde_json::to_string(url)
.map_err(|err| AppError::unexpected(format!("failed to encode redirect URL: {err}")))?;
let script = format!("<script>window.location.href={encoded_url}</script>");
let mut response = Html(script).into_response(); let mut response = Html(script).into_response();
response response
.headers_mut() .headers_mut()