From a1ee7cb38ba07269ad991cd0a8c86e67a2418611 Mon Sep 17 00:00:00 2001 From: hc-github-team-consul-core Date: Mon, 17 Jun 2024 14:05:02 -0700 Subject: [PATCH] Backport of [Security] Close cross scripting vulnerability into release/1.19.x (#21346) * backport of commit c8cb3349fe6f3cd8f4a56fab8c1248105d935324 * backport of commit 262efd8f15d4cabe31d95a76997405c46974545e --------- Co-authored-by: Sarah Alsmiller --- .changelog/21342.txt | 3 +++ agent/kvs_endpoint.go | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) create mode 100644 .changelog/21342.txt diff --git a/.changelog/21342.txt b/.changelog/21342.txt new file mode 100644 index 000000000000..d2850bc4fd30 --- /dev/null +++ b/.changelog/21342.txt @@ -0,0 +1,3 @@ +```release-note:security +agent: removed reflected cross-site scripting vulnerability +``` \ No newline at end of file diff --git a/agent/kvs_endpoint.go b/agent/kvs_endpoint.go index e60567cd5b80..65ec44307802 100644 --- a/agent/kvs_endpoint.go +++ b/agent/kvs_endpoint.go @@ -293,7 +293,7 @@ func conflictingFlags(resp http.ResponseWriter, req *http.Request, flags ...stri if _, ok := params[conflict]; ok { if found { resp.WriteHeader(http.StatusBadRequest) - fmt.Fprint(resp, "Conflicting flags: "+params.Encode()) + fmt.Fprintf(resp, "Conflicting flags: %v\n", params.Encode()) return true } found = true