pgadmin-org
/
pgadmin4
mirror of https://github.com/pgadmin-org/pgadmin4.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix an XSS issue in PSQL tool title

pull/6484/head
Aditya Toshniwal 2023-06-26 13:36:25 +05:30
parent 39359dd2f1
commit 8dc79e73bd
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
web/pgadmin/tools/psql/static/js/psql_module.js
View File

@ -154,6 +154,7 @@ export function initialize(gettext, url_for, _, pgAdmin, csrfToken, Browser) {
const [panelUrl, panelCloseUrl, db_label] = this.getPanelUrls(transId, panelTitle, parentData, gen);
const escapedTitle = _.escape(panelTitle);
let psqlToolForm = `
<form id="psqlToolForm" action="${panelUrl}" method="post">
<input id="title" name="title" hidden />
@ -161,7 +162,7 @@ export function initialize(gettext, url_for, _, pgAdmin, csrfToken, Browser) {
<input name="close_url" value="${panelCloseUrl}" hidden />
</form>
<script>
document.getElementById("title").value = "${_.escape(panelTitle)}";
document.getElementById("title").value = "${escapedTitle}";
document.getElementById("psqlToolForm").submit();
</script>
`;
@ -178,7 +179,7 @@ export function initialize(gettext, url_for, _, pgAdmin, csrfToken, Browser) {
registerDetachEvent(psqlToolPanel);
// Set panel title and icon
setPanelTitle(psqlToolPanel, panelTitle);
setPanelTitle(psqlToolPanel, escapedTitle);
psqlToolPanel.icon('fas fa-terminal psql-tab-style');
psqlToolPanel.focus();

4
web/pgadmin/tools/sqleditor/static/js/components/QueryToolComponent.jsx
View File

@ -263,8 +263,8 @@ export default function QueryToolComponent({params, pgWindow, pgAdmin, selectedN
});
}
api.post(baseUrl, qtState.params.is_query_tool ? {
user: qtState.params.user,
role: qtState.params.role,
user: selectedConn.user,
role: selectedConn.role,
password: password
} : JSON.stringify(qtState.params.sql_filter))
.then(()=>{