Backport of [Security] Close cross scripting vulnerability into relea…

…se/1.19.x (#21346) * backport of commit c8cb334 * backport of commit 262efd8 --------- Co-authored-by: Sarah Alsmiller <sarah.alsmiller@hashicorp.com>
hashicorp · Jun 17, 2024 · a1ee7cb · a1ee7cb
1 parent 09538e6
commit a1ee7cb
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/.changelog/21342.txt b/.changelog/21342.txt
@@ -0,0 +1,3 @@
+```release-note:security
+agent: removed reflected cross-site scripting vulnerability
+```
diff --git a/agent/kvs_endpoint.go b/agent/kvs_endpoint.go
@@ -293,7 +293,7 @@ func conflictingFlags(resp http.ResponseWriter, req *http.Request, flags ...stri
 		if _, ok := params[conflict]; ok {
 			if found {
 				resp.WriteHeader(http.StatusBadRequest)
-				fmt.Fprint(resp, "Conflicting flags: "+params.Encode())
+				fmt.Fprintf(resp, "Conflicting flags: %v\n", params.Encode())
 				return true
 			}
 			found = true