From a076aaecc6cba71f6869a26cabcf6644071877cc Mon Sep 17 00:00:00 2001 From: Josh Bleecher Snyder Date: Thu, 13 Jan 2022 13:03:00 -0800 Subject: [PATCH] cmd/tailscale: use html/template for synoTokenRedirect The GitHub code scanner flagged this as a security vulnerability. I don't believe it was, but I couldn't convince myself of it 100%. Err on the safe side and use html/template to generate the HTML, with all necessary escaping. Fixes tailscale/corp#2698 Signed-off-by: Josh Bleecher Snyder --- cmd/tailscale/cli/web.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cmd/tailscale/cli/web.go b/cmd/tailscale/cli/web.go index bf89e096e..3f4e188df 100644 --- a/cmd/tailscale/cli/web.go +++ b/cmd/tailscale/cli/web.go @@ -270,14 +270,14 @@ func synoTokenRedirect(w http.ResponseWriter, r *http.Request) bool { // We need a SynoToken for authenticate.cgi. // So we tell the client to get one. serverURL := r.URL.Scheme + "://" + r.URL.Host - fmt.Fprintf(w, synoTokenRedirectHTML, serverURL) + synoTokenRedirectHTML.Execute(w, serverURL) return true } -const synoTokenRedirectHTML = ` +var synoTokenRedirectHTML = template.Must(template.New("redirect").Parse(` Redirecting with session token... -` +`)) func webHandler(w http.ResponseWriter, r *http.Request) { if authRedirect(w, r) {