Potential XSS on mark_safe function
Bug #1908233 reported by
hanchl
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Dashboard (Horizon) |
New
|
Undecided
|
Unassigned |
Bug Description
When using make_safe function, it is easy to cause XSS attacks. However, there are a lot of make_safe function uses in the horizon code, such as using the dashboard interface to obtain instance information, using the render function for server-side rendering etc.. Should we consider adding keyword filtering to prevent attacks?
Examples for related code:
File: horizon\
235 output.
236 return mark_safe(
237
File: horizon\
1185 '</span>
1186 return mark_safe(
1187
summary: |
- subprocess_popen_with_shell_equals_true + Potential XSS on mark_safe function |
To post a comment you must log in.