Jo-Philipp Wich e2abb45b0e luci-mod-status: fix potential XSS via specially crafted DNS names
When an upstream NS returns PTR domain names containing HTML, it is
added verbatim to the connection status table.

Prevent this issue by HTML escaping any values in the source and
destination columns.

Fixes: CVE-2021-32019
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 3c66c5b1651aa25afbff09bee45047da9a0ba43d)
2021-05-12 12:03:00 +02:00
2020-08-31 13:01:55 +03:00
2020-08-06 17:58:47 +02:00
2019-11-07 12:39:24 +01:00
2019-11-07 12:39:24 +01:00
2019-11-07 12:39:24 +01:00

OpenWrt luci feed

Translation status

Description

This is the OpenWrt "luci"-feed containing LuCI - OpenWrt Configuration Interface.

Usage

This feed is enabled by default. Your feeds.conf.default (or feeds.conf) should contain a line like:

src-git luci https://github.com/openwrt/luci.git

To install all its package definitions, run:

./scripts/feeds update luci
./scripts/feeds install -a -p luci

API Reference

You can browse the generated API documentation directly on Github.

Development

Documentation for developing and extending LuCI can be found in the Wiki

License

See LICENSE file.

Package Guidelines

See CONTRIBUTING.md file.

Translation status

Translation status

Description
No description provided
Readme Apache-2.0 190 MiB
Languages
JavaScript 35.7%
C 24%
Lua 21%
HTML 8.6%
CSS 3.5%
Other 7.2%