diff options
| author | Stefan Fritsch <sf@apache.org> | 2012-12-08 20:32:00 +0000 |
|---|---|---|
| committer | Stefan Fritsch <sf@apache.org> | 2012-12-08 20:32:00 +0000 |
| commit | d5b414c34d90cd63196a9214872c55e390838a9c (patch) | |
| tree | fecc38ed7499a9e6d410560b79614b1d6ba0eb74 /modules/test | |
| parent | 310a0975a59bb0fd8dda049820ad4c46d067fec7 (diff) | |
| download | httpd-d5b414c34d90cd63196a9214872c55e390838a9c.tar.gz | |
CVE-2012-3499
add missing html escaping
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1418752 13f79535-47bb-0310-9956-ffa450edef68
Diffstat (limited to 'modules/test')
| -rw-r--r-- | modules/test/mod_policy.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/modules/test/mod_policy.c b/modules/test/mod_policy.c index 473b31c624..8138f83165 100644 --- a/modules/test/mod_policy.c +++ b/modules/test/mod_policy.c @@ -1011,7 +1011,8 @@ static const char *set_type_url(cmd_parms *cmd, void *dconf, const char *url) { policy_conf *conf = dconf; - conf->type_url = url; + /* url is only used inside <a href="...">, escape accordingly */ + conf->type_url = ap_escape_html(cmd->pool, url); conf->type_url_set = 1; return NULL; |