Bläddra i källkod

LibWeb: Fix HTML injection on FrameLoader error page

Small regression introduced by 3857148, we still have to escape HTML
entities.
Linus Groh 4 år sedan
förälder
incheckning
024fd9b957
1 ändrade filer med 2 tillägg och 2 borttagningar
  1. 2 2
      Userland/Libraries/LibWeb/Loader/FrameLoader.cpp

+ 2 - 2
Userland/Libraries/LibWeb/Loader/FrameLoader.cpp

@@ -229,8 +229,8 @@ void FrameLoader::load_error_page(const URL& failed_url, const String& error)
             VERIFY(!data.is_null());
             VERIFY(!data.is_null());
             StringBuilder builder;
             StringBuilder builder;
             SourceGenerator generator { builder };
             SourceGenerator generator { builder };
-            generator.set("failed_url", failed_url.to_string());
-            generator.set("error", error);
+            generator.set("failed_url", escape_html_entities(failed_url.to_string()));
+            generator.set("error", escape_html_entities(error));
             generator.append(data);
             generator.append(data);
             auto document = HTML::parse_html_document(generator.as_string_view(), failed_url, "utf-8");
             auto document = HTML::parse_html_document(generator.as_string_view(), failed_url, "utf-8");
             VERIFY(document);
             VERIFY(document);