CVE-2023-36812: Fix for #2269 and #2267 XSS vulnerability. · OpenTSDB/opentsdb@fa88d3e

Expand Up

@@ -25,6 +25,7 @@

import java.util.HashSet;

import java.util.List;

import com.google.common.html.HtmlEscapers;

import net.opentsdb.core.Const;

import net.opentsdb.core.TSDB;

import net.opentsdb.graph.Plot;

Expand Down Expand Up

@@ -373,14 +374,18 @@ public void internalError(final Exception cause) {

buf.append(“\"}”);

sendReply(HttpResponseStatus.INTERNAL_SERVER_ERROR, buf);

} else {

String response = "";

if (pretty_exc != null) {

response = HtmlEscapers.htmlEscaper().escape(pretty_exc);

}

sendReply(HttpResponseStatus.INTERNAL_SERVER_ERROR,

makePage("Internal Server Error", "Houston, we have a problem",

“<blockquote>”

+ “<h1>Internal Server Error</h1>”

+ “Oops, sorry but your request failed due to a”

+ " server error.<br/><br/>"

+ “Please try again in 30 seconds.<pre>”

+ pretty_exc

+ response

+ “</pre></blockquote>”));

}

}

Expand Down Expand Up

@@ -420,14 +425,18 @@ public void badRequest(final BadRequestException exception) {

buf.append(“\"}”);

sendReply(HttpResponseStatus.BAD_REQUEST, buf);

} else {

String response = "";

if (exception.getMessage() != null) {

response = HtmlEscapers.htmlEscaper().escape(exception.getMessage());

}

sendReply(HttpResponseStatus.BAD_REQUEST,

makePage("Bad Request", "Looks like it’s your fault this time",

“<blockquote>”

+ “<h1>Bad Request</h1>”

+ “Sorry but your request was rejected as being”

+ " invalid.<br/><br/>"

+ “The reason provided was:<blockquote>”

+ exception.getMessage()

+ response

+ “</blockquote></blockquote>”));

}

}

Expand Down