Changeset 3026 for lang/perl/Moxy

Timestamp:

12/11/07 01:16:23 (5 years ago)

Author:

tokuhirom

Message:

lang/perl/Moxy: fix XSS.

Location:

lang/perl/Moxy/trunk

Files:

• lib/Moxy/Plugin/Application.pm (modified) (1 diff)
• t/xss.t (added)

lang/perl/Moxy/trunk/lib/Moxy/Plugin/Application.pm

@@ -58 +58 @@
 sub _render_control_panel {
     my ($class, $base, $current_url) = @_;
-    return <<"...";
+
+    return sprintf(<<"...", encode_entities($current_url));
     <form method="get" action="$base">
-        <input type="text" name="q" value="$current_url" size="40" />
+        <input type="text" name="q" value="\%s" size="40" />
         <input type="submit" value="go" />
     </form>