From 5b442e5f1b9b81bfe8299259671ec43d3be129c3 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 11 Dec 2007 16:02:23 +0000 Subject: [PATCH] Fix CVE-2007-5000: * modules/mappers/mod_imagemap.c (menu_header): Fix cross-site-scripting issue by escaping the URI, and ensure that a charset parameter is sent in the content-type to prevent autodetection by broken browsers. Reported by: JPCERT git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@603282 13f79535-47bb-0310-9956-ffa450edef68 --- modules/mappers/mod_imagemap.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c index f4dce5ff20..f6741d35b4 100644 --- a/modules/mappers/mod_imagemap.c +++ b/modules/mappers/mod_imagemap.c @@ -479,13 +479,16 @@ static int imap_reply(request_rec *r, char *redirect) static void menu_header(request_rec *r, char *menu) { - ap_set_content_type(r, "text/html"); + ap_set_content_type(r, "text/html; charset=ISO-8859-1"); - ap_rvputs(r, DOCTYPE_HTML_3_2, "\nMenu for ", r->uri, - "\n\n", NULL); + ap_rvputs(r, DOCTYPE_HTML_3_2, "\nMenu for ", + ap_escape_html(r->pool, r->uri), + "\n\n", NULL); if (!strcasecmp(menu, "formatted")) { - ap_rvputs(r, "

Menu for ", r->uri, "

\n
\n\n", NULL); + ap_rvputs(r, "

Menu for ", + ap_escape_html(r->pool, r->uri), + "

\n
\n\n", NULL); } return; -- 2.40.0