forked from mirrors/pkg-proxy
9e97a3316aFile paths from archive contents were interpolated directly into onclick handlers and innerHTML via template literals. A crafted filename containing quotes could break out of the string context and execute arbitrary JS. Add an escapeHTML helper and use it on all interpolated path and URL values in the browse source page. |
||
|---|---|---|
| .. | ||
| browse_source.html | ||
| compare_versions.html | ||
| dashboard.html | ||
| install.html | ||
| package_show.html | ||
| packages_list.html | ||
| search.html | ||
| version_show.html | ||