IntenseWebs/pgadmin4
3
0
Fork 0
mirror of https://github.com/pgadmin-org/pgadmin4.git synced 2025-02-25 18:55:31 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fix an XSS issue in PSQL tool title

Browse Source
This commit is contained in:
Aditya Toshniwal
2023-06-26 13:36:25 +05:30
parent 39359dd2f1
commit 8dc79e73bd
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
web/pgadmin/tools/psql/static/js/psql_module.js
View File

@@ -154,6 +154,7 @@ export function initialize(gettext, url_for, _, pgAdmin, csrfToken, Browser) {
const [panelUrl, panelCloseUrl, db_label] = this.getPanelUrls(transId, panelTitle, parentData, gen);
const escapedTitle = _.escape(panelTitle);
let psqlToolForm = `
<form id="psqlToolForm" action="${panelUrl}" method="post">
<input id="title" name="title" hidden />
@@ -161,7 +162,7 @@ export function initialize(gettext, url_for, _, pgAdmin, csrfToken, Browser) {
<input name="close_url" value="${panelCloseUrl}" hidden />
</form>
<script>
document.getElementById("title").value = "${_.escape(panelTitle)}";
document.getElementById("title").value = "${escapedTitle}";
document.getElementById("psqlToolForm").submit();
</script>
`;
@@ -178,7 +179,7 @@ export function initialize(gettext, url_for, _, pgAdmin, csrfToken, Browser) {
registerDetachEvent(psqlToolPanel);
// Set panel title and icon
setPanelTitle(psqlToolPanel, panelTitle);
setPanelTitle(psqlToolPanel, escapedTitle);
psqlToolPanel.icon('fas fa-terminal psql-tab-style');
psqlToolPanel.focus();