diff options
| author | Will Coster <willcoster@google.com> | 2016-03-31 10:22:29 -0700 |
|---|---|---|
| committer | Will Coster <willcoster@google.com> | 2016-03-31 10:22:29 -0700 |
| commit | 55bffe1782fc04697da4f76d5b8d0d1bd1636862 (patch) | |
| tree | a827bb2b3fdc1c0eb1e5a3f62264091f952f5e4a /test/netlib/http/http2/test_connections.py | |
| parent | f1c5721c8c6bd2fea1e9f2c0c6fdea099c9ae3de (diff) | |
| download | mitmproxy-55bffe1782fc04697da4f76d5b8d0d1bd1636862.tar.gz mitmproxy-55bffe1782fc04697da4f76d5b8d0d1bd1636862.tar.bz2 mitmproxy-55bffe1782fc04697da4f76d5b8d0d1bd1636862.zip | |
Fix XSS vulnerability in HTTP errors
The make_error_response method does not properly escape characters
that end up in the response body. Since the error code can contain
user supplied values this leads to a potential XSS vulnerability.
Example:
echo '<script>alert(1)</script>' | nc localhost 8888
Diffstat (limited to 'test/netlib/http/http2/test_connections.py')
0 files changed, 0 insertions, 0 deletions