snac2

commit 5be22394675bff99cae673251696f8d0ce8ce0de
parent 57761020b71161fbed85079e349b8d222d931042
Author: default <nobody@localhost>
Date:   Fri, 16 Jun 2023 09:25:32 +0200

Quick fix to "Script self-injection in edit box".

In the 'Edit...' box, the sourceContent (which was written by a user)
has its < replaced with &lt; . This issue does not propagate to the
public timeline nor to the recipients of the post.

Reference: https://codeberg.org/grunfink/snac2/issues/53

Diffstat:
M
html.c
 | 
6
++++--

1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/html.c b/html.c
@@ -668,9 +668,11 @@ xs_str *html_entry_controls(snac *snac, xs_str *os, const xs_dict *msg, const ch
 
     s = xs_str_cat(s, "</form>\n");
 
-    char *prev_src = xs_dict_get(msg, "sourceContent");
+    const char *prev_src1 = xs_dict_get(msg, "sourceContent");
+
+    if (!xs_is_null(prev_src1) && strcmp(actor, snac->actor) == 0) {
+        xs *prev_src = xs_replace(prev_src1, "<", "&lt;");
 
-    if (!xs_is_null(prev_src) && strcmp(actor, snac->actor) == 0) {
         /* post can be edited */
         xs *s1 = xs_fmt(
             "<p><details><summary>%s</summary>\n"