Skip to content

Fix XSS attack vector #1264

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
josevalim merged 5 commits into from
Mar 14, 2025
+2 −2
Merged

Fix XSS attack vector #1264

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
12b1acf
Fix XSS attack vector
i-n-g-m-a-r Mar 14, 2025
c33fbd4
Fix query_string and headers as well
i-n-g-m-a-r Mar 14, 2025
d715f21
Escape whole textarea content
i-n-g-m-a-r Mar 14, 2025
7cde270
The copy button uses textContent instead of innerHTML
i-n-g-m-a-r Mar 14, 2025
53db5fc
Escaping in the markdown template itself is not necessary
i-n-g-m-a-r Mar 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion lib/plug/debugger.ex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -234,7 +234,7 @@ defmodule Plug.Debugger do
Keyword.merge(assigns,
conn: conn,
message: maybe_autolink(message),
markdown: markdown,
markdown: h(markdown),
style: style,
banner: banner,
actions: actions,
Expand Down
2 changes: 1 addition & 1 deletion lib/plug/templates/debugger.html.eex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1057,7 +1057,7 @@
function copyToClipboard () {
if(navigator.clipboard) {
// For those working on localhost or HTTPS
navigator.clipboard.writeText($copy.innerHTML).then(copiedClipboard).catch(() => {})
navigator.clipboard.writeText($copy.textContent).then(copiedClipboard).catch(() => {})
} else {
// For those working on HTTP
$copy.select()
Expand Down