From c7df129fddfc9abb6abe20895201b51f10e48b5f Mon Sep 17 00:00:00 2001
From: sysops <sysops@LenovoT14Gen5>
Date: Sat, 11 Jul 2026 23:24:45 +0200
Subject: [PATCH] Escape server name before HTML interpolation in servers.html

obj.name is free text (unlike id/interface, which are already
regex-validated server-side) and was being template-literal'd
straight into innerHTML - stored-XSS risk if a server name contains
markup. Escape via jQuery .text()/.html() round-trip.
---
 templates/servers.html | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/templates/servers.html b/templates/servers.html
index 74955a6..debeb13 100644
--- a/templates/servers.html
+++ b/templates/servers.html
@@ -80,6 +80,10 @@ Servers
             const listenPort = obj.Interface ? obj.Interface.listen_port : "";
             const interfaceName = obj.Interface ? obj.Interface.name : "";
 
+            // obj.id/interfaceName are server-side validated against [a-zA-Z0-9_-],
+            // safe to interpolate; obj.name is free text and must be escaped.
+            const safeName = $('<div>').text(obj.name).html();
+
             let html = `<div class="col-sm-6 col-md-6 col-lg-4" id="server_${obj.id}">
                             <div class="info-box">
                                 <div class="info-box-content">
@@ -87,7 +91,7 @@ Servers
                                         <a href="{{.basePath}}/servers/${obj.id}/clients" class="btn btn-outline-primary btn-sm">Manage clients</a>
                                     </div>
                                     <hr>
-                                    <span class="info-box-text"><i class="fas fa-server"></i> ${obj.name}</span>
+                                    <span class="info-box-text"><i class="fas fa-server"></i> ${safeName}</span>
                                     <span class="info-box-text"><i class="fas fa-fingerprint"></i> ID: ${obj.id}</span>
                                     <span class="info-box-text"><i class="fas fa-ethernet"></i> Interface: ${interfaceName}</span>
                                     <span class="info-box-text"><i class="fas fa-plug"></i> Listen Port: ${listenPort}</span>