Fixed XSS on #347

yogeshojha · Feb 23, 2021 · 3dbeb53 · 3dbeb53
1 parent 2653217
commit 3dbeb53
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/startScan/templates/startScan/detail_vuln_scan.html b/startScan/templates/startScan/detail_vuln_scan.html
@@ -164,21 +164,21 @@ <h5 class="text-danger">Vulnerability Scan Results</h5>
 			},
 			{
 				"render": function ( data, type, row ) {
-					return "<a href='"+data+"' target='_blank' class='text-danger'>"+data+"</a>";
+					return "<a href='"+htmlEncode(data)+"' target='_blank' class='text-danger'>"+htmlEncode(data)+"</a>";
 				},
 				"targets": 3,
 			},
 			{
 				"render": function ( data, type, row ) {
 					// Could be better
 					if (data && row['matcher_name']) {
-						return data + "\n" + row['matcher_name'];
+						return htmlEncode(data) + "\n" + row['matcher_name'];
 					}
 					else if (data) {
-						return data;
+						return htmlEncode(data);
 					}
 					else if (row['matcher_name']) {
-						return row['matcher_name'].charAt(0).toUpperCase() + row['matcher_name'].slice(1);
+						return htmlEncode(row['matcher_name']).charAt(0).toUpperCase() + htmlEncode(row['matcher_name']).slice(1);
 					}
 					else {
 						return "";
@@ -188,7 +188,7 @@ <h5 class="text-danger">Vulnerability Scan Results</h5>
 			},
 			{
 				"render": function ( data, type, row ) {
-					return data;
+					return htmlEncode(data);
 				},
 				"targets": 5,
 			},