scripte/wireguard-ui-multi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Escape server name before HTML interpolation in servers.html

Browse Source 
obj.name is free text (unlike id/interface, which are already
regex-validated server-side) and was being template-literal'd
straight into innerHTML - stored-XSS risk if a server name contains
markup. Escape via jQuery .text()/.html() round-trip.
This commit is contained in:
sysops
2026-07-11 23:24:45 +02:00
parent 3842c7a534
commit c7df129fdd
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/servers.html
+5 -1
View File
@@ -80,6 +80,10 @@ Servers
const listenPort = obj.Interface ? obj.Interface.listen_port : "";
const interfaceName = obj.Interface ? obj.Interface.name : "";
// obj.id/interfaceName are server-side validated against [a-zA-Z0-9_-],
// safe to interpolate; obj.name is free text and must be escaped.
const safeName = $('<div>').text(obj.name).html();
let html = `<div class="col-sm-6 col-md-6 col-lg-4" id="server_${obj.id}">
<div class="info-box">
<div class="info-box-content">
@@ -87,7 +91,7 @@ Servers
<a href="{{.basePath}}/servers/${obj.id}/clients" class="btn btn-outline-primary btn-sm">Manage clients</a>
</div>
<hr>
<span class="info-box-text"><i class="fas fa-server"></i> ${obj.name}</span>
<span class="info-box-text"><i class="fas fa-server"></i> ${safeName}</span>
<span class="info-box-text"><i class="fas fa-fingerprint"></i> ID: ${obj.id}</span>
<span class="info-box-text"><i class="fas fa-ethernet"></i> Interface: ${interfaceName}</span>
<span class="info-box-text"><i class="fas fa-plug"></i> Listen Port: ${listenPort}</span>