Merge pull request #694 from 418sec/1-pip-cabot

Security Fix for Stored Cross-site Scripting (XSS) - huntr.dev
arachnys · Jan 5, 2021 · eb0b354 · eb0b354
2 parents b18b1a0 + b788986
commit eb0b354
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/cabot/cabotapp/models/base.py b/cabot/cabotapp/models/base.py
@@ -9,6 +9,7 @@
 
 from celery.exceptions import SoftTimeLimitExceeded
 from celery.utils.log import get_task_logger
+from django.core.validators import URLValidator
 from django.conf import settings
 from django.contrib.auth.models import User
 from django.db import models
@@ -472,6 +473,7 @@ class StatusCheck(PolymorphicModel):
     endpoint = models.TextField(
         null=True,
         help_text='HTTP(S) endpoint to poll.',
+        validators = [URLValidator()],
     )
     username = models.TextField(
         blank=True,

diff --git a/cabot/templates/cabotapp/statuscheck_detail.html b/cabot/templates/cabotapp/statuscheck_detail.html
@@ -78,7 +78,7 @@ <h3 class="pull-left">Check results</h3>
           </td>
           <td>{{ result.time_complete }}</td>
           <td>{{ result.took }}</td>
-          <td>{% autoescape off %}{{ result.error|default:"" }}{% endautoescape %}</td>
+          <td>{{ result.error|default:"" }}</td>
         </tr>
       {% endfor %}
       </tbody>