bug / pagure

Clone
Source Code
GIT

b5e046 Do not serve svg inline

1 file Authored by Michael Scherer 7 years ago , Committed by Pierre-Yves Chibon 7 years ago ,
raw patch tree parent
1 file changed. 1 lines added. 1 lines removed.
pagure/lib/mimetype.py
file modified
+1 -1 
    Do not serve svg inline
    
    SVG can contain javascript, so that's a easy vector for XSS on pagure.
    
    Fix CVE-2018-1002155
    
    Signed-off-by: Michael Scherer <misc@redhat.com>
file modified
+1 -1

Powered by Pagure 5.11.3

SSH Hostkey/Fingerprint | Documentation | About

© 2014-2019 Red Hat, Inc. and others.

Logo by Pavel Lashutin