From: Joe Orton Date: Tue, 11 Dec 2007 16:02:23 +0000 (+0000) Subject: Fix CVE-2007-5000: X-Git-Tag: 2.3.0~1151 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5b442e5f1b9b81bfe8299259671ec43d3be129c3;p=thirdparty%2Fapache%2Fhttpd.git Fix CVE-2007-5000: * modules/mappers/mod_imagemap.c (menu_header): Fix cross-site-scripting issue by escaping the URI, and ensure that a charset parameter is sent in the content-type to prevent autodetection by broken browsers. Reported by: JPCERT git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@603282 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c index f4dce5ff20e..f6741d35b4e 100644 --- a/modules/mappers/mod_imagemap.c +++ b/modules/mappers/mod_imagemap.c @@ -479,13 +479,16 @@ static int imap_reply(request_rec *r, char *redirect) static void menu_header(request_rec *r, char *menu) { - ap_set_content_type(r, "text/html"); + ap_set_content_type(r, "text/html; charset=ISO-8859-1"); - ap_rvputs(r, DOCTYPE_HTML_3_2, "\nMenu for ", r->uri, - "\n\n", NULL); + ap_rvputs(r, DOCTYPE_HTML_3_2, "\nMenu for ", + ap_escape_html(r->pool, r->uri), + "\n\n", NULL); if (!strcasecmp(menu, "formatted")) { - ap_rvputs(r, "

Menu for ", r->uri, "

\n\n", NULL); + ap_rvputs(r, "

Menu for ", + ap_escape_html(r->pool, r->uri), + "

\n\n", NULL); } return;