From 0f0ecf68b31303de7cb428554e27d433fe62180e Mon Sep 17 00:00:00 2001 From: Jeff King Date: Mon, 12 Nov 2012 16:34:28 -0500 Subject: gitweb: escape html in rss title The title of an RSS feed is generated from many components, including the filename provided as a query parameter, but we failed to quote it. Besides showing the wrong output, this is a vector for XSS attacks. Signed-off-by: Jeff King --- gitweb/gitweb.perl | 1 + 1 file changed, 1 insertion(+) (limited to 'gitweb') diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl index 10ed9e51a..a51a8babe 100755 --- a/gitweb/gitweb.perl +++ b/gitweb/gitweb.perl @@ -8055,6 +8055,7 @@ sub git_feed { $feed_type = 'history'; } $title .= " $feed_type"; + $title = esc_html($title); my $descr = git_get_project_description($project); if (defined $descr) { $descr = esc_html($descr); -- cgit v1.2.1