pages/pages-server
1
0
Fork 0
mirror of https://codeberg.org/Codeberg/pages-server.git synced 2025-04-25 06:16:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix xss on error page

Browse source
This commit is contained in:
crapStone 2022-12-02 17:19:43 +01:00
parent dcf03fc078
commit 019d942249
No known key found for this signature in database
GPG key ID: 4CAA9E39EEDEB1F0
3 changed files with 58 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

32
html/error.go
View file

@ -15,16 +15,28 @@ func ReturnErrorPage(ctx *context.Context, msg string, statusCode int) {
ctx.RespWriter.Header().Set("Content-Type", "text/html; charset=utf-8")
ctx.RespWriter.WriteHeader(statusCode)
if msg == "" {
msg = errorBody(statusCode)
} else {
// TODO: use template engine
msg = strings.ReplaceAll(strings.ReplaceAll(ErrorPage, "%message%", msg), "%status%", http.StatusText(statusCode))
}
msg = generateResponse(msg, statusCode)
_, _ = ctx.RespWriter.Write([]byte(msg))
}
// TODO: use template engine
func generateResponse(msg string, statusCode int) string {
if msg == "" {
msg = strings.ReplaceAll(NotFoundPage,
"%status%",
strconv.Itoa(statusCode)+" "+errorMessage(statusCode))
} else {
msg = strings.ReplaceAll(
strings.ReplaceAll(ErrorPage, "%message%", template.HTMLEscapeString(msg)),
"%status%",
http.StatusText(statusCode))
}
return msg
}
func errorMessage(statusCode int) string {
message := http.StatusText(statusCode)
@ -37,11 +49,3 @@ func errorMessage(statusCode int) string {
return message
}
// TODO: use template engine
func errorBody(statusCode int) string {
return template.HTMLEscapeString(
strings.ReplaceAll(NotFoundPage,
"%status%",
strconv.Itoa(statusCode)+" "+errorMessage(statusCode)))
}