Mercurial > p > roundup > code
view doc/format_config.awk @ 8356:63390dcfcfe9
bug: fix template use of structure with untrusted data
Looks like an xSS bug with an early version of the template that was
fixed in the code but never in the deployed tracker. It has been a
while since this particular construct has been in the classic template
which is the base for the tracker.
This has been fixed on the deployed tracker as well.
reported by 4bug of ChaMd5 Security Team H1 Group
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 08 Jul 2025 10:23:09 -0400 |
| parents | c3bf229d3d4b |
| children | 20943bf4f1b7 |
line wrap: on
line source
#! /bin/awk BEGIN {SECRET_KEY = "DWmbKgVUy6fF5D2Y5TD5Az+dnHhMYKCCpJzIY3H8nsU="} # delete first 8 lines NR < 9 {next} # To prevent new file generation from causing the secret_key to # change, we replace the secret key with a fixed value. /^# Default: [0-9A-z+=]{44}/ {sub(/[0-9A-z+=]{44}/, SECRET_KEY)} /^secret_key = [0-9A-z+=]{44}/ {sub(/[0-9A-z+=]{44}/, SECRET_KEY)} # When we see a section [label]: # emit section index marker, # emit section anchor # set up for code formating # emit any comments/blank line that are accumulated before the # section marker # print the indented section marker # # zero the accumulator and the variable that prevents large blocks # of empty lines. /^\[([a-z]*)\]/ { match($0, /^\[([a-z]*)\].*/, section_match); section = section_match[1]; print("\n\n.. index:: config.ini; sections " section); print(".. _`config-ini-section-" section "`:"); print(".. code:: ini\n"); if (accumulate) { print(" " accumulate "\n"); } print(" " $0); accumulate = ""; prev_line_is_blank = 0; } # if the line is a setting line (even if commented out) # print the accumulated comments/blank lines and the setting line # zero the accumulator and the variable that prevents blocks of blank lines # get the next input line /^#?[a-z0-9_-]* =/ { print accumulate "\n " $0; accumulate = ""; prev_line_is_blank = 0; next; } # accumulate comment lines and indent them /^#/ { accumulate = accumulate "\n " $0; prev_line_is_blank = 0;} # accumulate a blank line only if the previous line was not blank. /^$/ { if (! prev_line_is_blank) {accumulate = accumulate $0}; prev_line_is_blank = 1; }
