Skip to content
This repository has been archived by the owner on Dec 13, 2022. It is now read-only.

fix(conf): protect hostname resolver from XSS #7043

Merged
merged 3 commits into from
Jan 9, 2019
Merged

fix(conf): protect hostname resolver from XSS #7043

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b960d06
fix(conf): protect hostname resolver from XSS
vhr Dec 12, 2018
5c94505
fix(config): escape IP column in list too
vhr Dec 20, 2018
31c9f54
fix(mon): prevent showing of html tags in host.host_address column
vhr Jan 3, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion www/include/configuration/configObject/host/listHost.ihtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@
</a>
</td>
<td class="ListColLeft resizeTitle"><a href="{$elemArr[elem].RowMenu_link}">{$elemArr[elem].RowMenu_desc}</a></td>
<td class="ListColCenter">{$elemArr[elem].RowMenu_address}</td>
<td class="ListColCenter">{$elemArr[elem].RowMenu_address|escape:'htmlall'}</td>
<td class="ListColCenter">{$elemArr[elem].RowMenu_poller}</td>
<td class="ListColCenter resizeTitle">{$elemArr[elem].RowMenu_parent}</td>
<td class="ListColCenter"><span class="badge {$elemArr[elem].RowMenu_badge}">{$elemArr[elem].RowMenu_status}</span></td>
Expand Down
4 changes: 3 additions & 1 deletion www/include/configuration/configObject/host/resolveHostName.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,4 +57,6 @@
/**
* Resolving host name
*/
echo gethostbyname($_GET['hostName']);
$hostName = $_GET['hostName'];

echo gethostbyname($hostName);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should not be better echo htmlentities(gethostbyname($hostName)); ?

Copy link
Contributor Author

@vhr vhr Dec 12, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we do that the result will be:
screenshot from 2018-12-12 10-56-55

I propose to strip the tags and remove all chars that are not compatible with the hostname.

2 changes: 1 addition & 1 deletion www/include/monitoring/objectDetails/template/hostDetails.ihtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<tr class='ListHeader'> <!-- Header -->
<td class="ListColHeaderLeft {$host_data.status_class}" >
<h3 style="color: #fff;">
<img src='./img/icons/host.png' width="16px" style="vertical-align:middle;" {if $h_ext_icon_image_alt} alt='{$h_ext_icon_image_alt}'{/if}> {$host_data.name} / {$host_data.alias} <span>[{$host_data.address}]</span>
<img src='./img/icons/host.png' width="16px" style="vertical-align:middle;" {if $h_ext_icon_image_alt} alt='{$h_ext_icon_image_alt}'{/if}> {$host_data.name} / {$host_data.alias} <span>[{$host_data.address|escape:'htmlall'}]</span>
</h3>
{if $sv_ext_notes_url}
<a href="{$sv_ext_notes_url}" target="_blank">
Expand Down
2 changes: 1 addition & 1 deletion www/include/monitoring/objectDetails/template/serviceDetails.ihtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
{$m_mon_services} {$svc_display_name}
{if $is_meta == 'false'}
<p style="padding-left: 28px; font-size: 12px;float:right;">
{$h.host_alias} | {$h.host_address}
{$h.host_alias} | {$h.host_address|escape:'htmlall'}
</p>
{/if}
</h3>
Expand Down