pagure

#231 Sanitize project names before creating them
Closed: Fixed Opened by codeblock.

Closed: Fixed
Reopen Issue

I attempted to test for another XSS hole on dev.pagure, but I ended up with a project that I now cannot delete or access: http://dev.pagure.org/%3Cscript%3Ealert%28%22ut%20oh%22%29%3B%3C/script%3E

This is because the new project form seems free-form, but (I assume) the URL routing handler isn't.

Implemented in https://pagure.io/pagure/pull-request/233

Merged
Metadata

0.2

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.