fic
/
server
2
0
Fork 0
Code Issues Pull Requests 10 Releases Wiki Activity

backend: fix XSS in team name and events

This commit is contained in:
nemunaire 2020-01-30 18:59:45 +01:00
parent ca8bac1ac8
commit 429cd3010c
4 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
backend/hint.go
View File

@ -5,6 +5,7 @@ import (
"encoding/binary"
"encoding/json"
"fmt"
"html"
"io/ioutil"
"log"
"math/rand"
@ -49,7 +50,7 @@ func treatOpeningHint(pathname string, team fic.Team) {
log.Printf("%s [WRN] %s\n", id, err)
} else if theme, err := fic.GetTheme(exercice.IdTheme); err != nil {
log.Printf("%s [WRN] %s\n", id, err)
} else if _, err = fic.NewEvent(fmt.Sprintf("L'équipe %s a dévoilé un indice pour le <strong>%d<sup>e</sup></strong> défi %s&#160;!", team.Name, lvl, theme.Name), "info"); err != nil {
} else if _, err = fic.NewEvent(fmt.Sprintf("L'équipe %s a dévoilé un indice pour le <strong>%d<sup>e</sup></strong> défi %s&#160;!", html.EscapeString(team.Name), lvl, theme.Name), "info"); err != nil {
log.Printf("%s [WRN] Unable to create event: %s\n", id, err)
}

3
backend/registration.go
View File

@ -5,6 +5,7 @@ import (
"encoding/binary"
"encoding/json"
"fmt"
"html"
"io/ioutil"
"log"
"math/rand"
@ -86,7 +87,7 @@ func treatRegistration(pathname string, team_id string) {
if err := os.Remove(pathname); err != nil {
log.Printf("%s [WRN] %s\n", id, err)
}
if _, err := fic.NewEvent(fmt.Sprintf("Souhaitons bonne chance à l'équipe <strong>%s</strong> qui vient de nous rejoindre&#160;!", team.Name), "info"); err != nil {
if _, err := fic.NewEvent(fmt.Sprintf("Souhaitons bonne chance à l'équipe <strong>%s</strong> qui vient de nous rejoindre&#160;!", html.EscapeString(team.Name)), "info"); err != nil {
log.Printf("%s [WRN] Unable to create event: %s\n", id, err)
}

3
backend/rename.go
View File

@ -5,6 +5,7 @@ import (
"encoding/binary"
"encoding/json"
"fmt"
"html"
"io/ioutil"
"log"
"math/rand"
@ -38,7 +39,7 @@ func treatRename(pathname string, team fic.Team) {
log.Printf("%s [WRN] Unable to change team name: %s\n", id, err)
}
genTeamQueue <- &team
if _, err := fic.NewEvent(fmt.Sprintf("Souhaitons bonne chance à l'équipe <strong>%s</strong> qui vient de nous rejoindre&#160;!", team.Name), "info"); err != nil {
if _, err := fic.NewEvent(fmt.Sprintf("Souhaitons bonne chance à l'équipe <strong>%s</strong> qui vient de nous rejoindre&#160;!", html.EscapeString(team.Name)), "info"); err != nil {
log.Printf("%s [WRN] Unable to create event: %s\n", id, err)
}
appendGenQueue(genStruct{Type: GenEvents})

5
backend/submission.go
View File

@ -5,6 +5,7 @@ import (
"encoding/binary"
"encoding/json"
"fmt"
"html"
"io/ioutil"
"log"
"math/rand"
@ -127,7 +128,7 @@ func treatSubmission(pathname string, team fic.Team, exercice_id string) {
// Write event
if lvl, err := exercice.GetLevel(); err != nil {
log.Println(id, "[ERR] Unable to get exercice level:", err)
} else if _, err := fic.NewEvent(fmt.Sprintf("L'équipe %s a résolu le <strong>%d<sup>e</sup></strong> défi %s&#160;!", team.Name, lvl, theme.Name), "success"); err != nil {
} else if _, err := fic.NewEvent(fmt.Sprintf("L'équipe %s a résolu le <strong>%d<sup>e</sup></strong> défi %s&#160;!", html.EscapeString(team.Name), lvl, theme.Name), "success"); err != nil {
log.Println(id, "[WRN] Unable to create event:", err)
}
genTeamQueue <- &team
@ -140,7 +141,7 @@ func treatSubmission(pathname string, team fic.Team, exercice_id string) {
if tm.Unix() == 0 {
if lvl, err := exercice.GetLevel(); err != nil {
log.Println(id, "[ERR] Unable to get exercice level:", err)
} else if _, err := fic.NewEvent(fmt.Sprintf("L'équipe %s tente le <strong>%d<sup>e</sup></strong> défi %s&#160;!", team.Name, lvl, theme.Name), "warning"); err != nil {
} else if _, err := fic.NewEvent(fmt.Sprintf("L'équipe %s tente le <strong>%d<sup>e</sup></strong> défi %s&#160;!", html.EscapeString(team.Name), lvl, theme.Name), "warning"); err != nil {
log.Println(id, "[WRN] Unable to create event:", err)
}
}