archive
/
tailscale
mirror of https://github.com/tailscale/tailscale/
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

cmd/tailscale: use html/template for synoTokenRedirect

Browse Source 
The GitHub code scanner flagged this as a security vulnerability.
I don't believe it was, but I couldn't convince myself of it 100%.
Err on the safe side and use html/template to generate the HTML,
with all necessary escaping.

Fixes tailscale/corp#2698

Signed-off-by: Josh Bleecher Snyder <josh@tailscale.com>
pull/3732/head
Josh Bleecher Snyder 4 years ago committed by Josh Bleecher Snyder
parent 27da7fd5cb
commit a076aaecc6
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File

8
cmd/tailscale/cli/web.go
Unescape Escape View File

@ -270,14 +270,14 @@ func synoTokenRedirect(w http.ResponseWriter, r *http.Request) bool {
// We need a SynoToken for authenticate.cgi. // We need a SynoToken for authenticate.cgi.
// So we tell the client to get one. // So we tell the client to get one.
serverURL := r.URL.Scheme + "://" + r.URL.Host serverURL := r.URL.Scheme + "://" + r.URL.Host
fmt.Fprintf(w, synoTokenRedirectHTML, serverURL) synoTokenRedirectHTML.Execute(w, serverURL)
return true return true
} }
const synoTokenRedirectHTML = `<html><body> var synoTokenRedirectHTML = template.Must(template.New("redirect").Parse(`<html><body>
Redirecting with session token... Redirecting with session token...
<script> <script>
var serverURL = %q; var serverURL = {{ . }};
var req = new XMLHttpRequest(); var req = new XMLHttpRequest();
req.overrideMimeType("application/json"); req.overrideMimeType("application/json");
req.open("GET", serverURL + "/webman/login.cgi", true); req.open("GET", serverURL + "/webman/login.cgi", true);
@ -289,7 +289,7 @@ req.onload = function() {
req.send(null); req.send(null);
</script> </script>
</body></html> </body></html>
` `))
func webHandler(w http.ResponseWriter, r *http.Request) { func webHandler(w http.ResponseWriter, r *http.Request) {
if authRedirect(w, r) { if authRedirect(w, r) {

Write Preview
Loading…
Cancel
Save