mirror of
https://github.com/dgtlmoon/changedetection.io.git
synced 2026-08-26 08:06:39 +00:00
21 lines
929 B
Python
21 lines
929 B
Python
from flask import make_response
|
|
|
|
|
|
def plaintext_response(message, status):
|
|
"""
|
|
Error response for a body that may contain caller-supplied text.
|
|
|
|
Flask's make_response() defaults to Content-Type: text/html, so any user input echoed
|
|
into an error body becomes reflected XSS. That is the failure behind
|
|
GHSA-23mp-8222-96fr (/diff/<uuid>/download-patch), CVE-2026-27645 (/rss/watch/) and
|
|
CVE-2026-29038 (/rss/tag/) - three instances of one pattern. Forcing text/plain means
|
|
the browser will not parse the body as markup even if input does reach it.
|
|
|
|
Prefer validating input over relying on this, but use it on error paths regardless:
|
|
exception text routinely carries values nobody audited (selectors, timestamps,
|
|
filesystem paths from snapshot reads).
|
|
"""
|
|
response = make_response(message, status)
|
|
response.headers['Content-Type'] = 'text/plain; charset=utf-8'
|
|
return response
|