diff options
| author | Leo <leo@yacy-contrib> | 2026-04-20 22:51:37 +0800 |
|---|---|---|
| committer | Leo <leo@yacy-contrib> | 2026-04-20 22:51:37 +0800 |
| commit | babfe58049c079bbb1e476e1d251aa72a0bba469 (patch) | |
| tree | ec33ad870af939e168d65d27e668f820dfae0c7b | |
| parent | 7b303b6f82b1eee57c05e984ce7f4f42fc992405 (diff) | |
fix: HTML-escape prefermaskfilter in early-return path to prevent reflected XSS (#401)
In the early return path (no index / search not allowed), prefermaskfilter was
reflected into value="#[prefermaskfilter]#" in yacysearch.html using prop.put(),
allowing attribute-breaking XSS. The normal search path already used putHTML;
apply the same to the early-return path.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
| -rw-r--r-- | source/net/yacy/htroot/yacysearch.java | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source/net/yacy/htroot/yacysearch.java b/source/net/yacy/htroot/yacysearch.java index dbe77d1ec..05647672d 100644 --- a/source/net/yacy/htroot/yacysearch.java +++ b/source/net/yacy/htroot/yacysearch.java @@ -188,7 +188,7 @@ public class yacysearch { prop.put("offset", "0"); prop.put("resource", "global"); prop.put("urlmaskfilter", (post == null) ? ".*" : post.get("urlmaskfilter", ".*")); - prop.put("prefermaskfilter", (post == null) ? "" : post.get("prefermaskfilter", "")); + prop.putHTML("prefermaskfilter", (post == null) ? "" : post.get("prefermaskfilter", "")); prop.put("indexof", "off"); prop.put("constraint", ""); prop.put("depth", "0"); |