vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix XSS in access token display page

Browse source 
Fixes https://jira.coreos.com/browse/QS-81
This commit is contained in:
Joseph Schorr 2017-12-06 13:40:31 -05:00
parent 4a5626e64b
commit f9219721a2
1 changed files with 15 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
templates/generatedtoken.html
View file

@ -4,23 +4,24 @@
<link rel="stylesheet" href="//netdna.bootstrapcdn.com/font-awesome/4.0.3/css/font-awesome.css"> <link rel="stylesheet" href="//netdna.bootstrapcdn.com/font-awesome/4.0.3/css/font-awesome.css">
<link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.0.0/css/bootstrap.no-icons.min.css"> <link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.0.0/css/bootstrap.no-icons.min.css">
<link href='//fonts.googleapis.com/css?family=Droid+Sans:400,700' rel='stylesheet' type='text/css'> <link href='//fonts.googleapis.com/css?family=Droid+Sans:400,700' rel='stylesheet' type='text/css'>
</head>
<body>
<div class="container" style="margin-top: 20px">
<img src="/static/img/quay-logo.png">
<h5>Access Token:
<script type="text/javascript"> <script type="text/javascript">
function setToken() {
var hash = document.location.hash.substr(1); var hash = document.location.hash.substr(1);
var pairs = hash.split('&'); var pairs = hash.split('&');
for (var i = 0; i < pairs.length; ++i) { for (var i = 0; i < pairs.length; ++i) {
var pair = pairs[i]; var pair = pairs[i];
var kv = pair.split('='); var kv = pair.split('=');
if (kv[0] == 'access_token') { if (kv[0] == 'access_token') {
document.write(kv[1]); document.getElementById('accesstoken').appendChild(document.createTextNode(kv[1]));
}
} }
} }
</script> </script>
</h5> </head>
<body onload="setToken()">
<div class="container" style="margin-top: 20px">
<img src="/static/img/quay-logo.png">
<h5>Access Token: <span id="accesstoken"></span></h5>
</div> </div>
</body> </body>
</html> </html>