From babfe58049c079bbb1e476e1d251aa72a0bba469 Mon Sep 17 00:00:00 2001 From: Leo Date: Mon, 20 Apr 2026 22:51:37 +0800 Subject: fix: HTML-escape prefermaskfilter in early-return path to prevent reflected XSS (#401) In the early return path (no index / search not allowed), prefermaskfilter was reflected into value="#[prefermaskfilter]#" in yacysearch.html using prop.put(), allowing attribute-breaking XSS. The normal search path already used putHTML; apply the same to the early-return path. Co-Authored-By: Claude Sonnet 4.6 --- source/net/yacy/htroot/yacysearch.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source') diff --git a/source/net/yacy/htroot/yacysearch.java b/source/net/yacy/htroot/yacysearch.java index dbe77d1ec..05647672d 100644 --- a/source/net/yacy/htroot/yacysearch.java +++ b/source/net/yacy/htroot/yacysearch.java @@ -188,7 +188,7 @@ public class yacysearch { prop.put("offset", "0"); prop.put("resource", "global"); prop.put("urlmaskfilter", (post == null) ? ".*" : post.get("urlmaskfilter", ".*")); - prop.put("prefermaskfilter", (post == null) ? "" : post.get("prefermaskfilter", "")); + prop.putHTML("prefermaskfilter", (post == null) ? "" : post.get("prefermaskfilter", "")); prop.put("indexof", "off"); prop.put("constraint", ""); prop.put("depth", "0"); -- cgit v1.2.3