From 13a2880fa0d27298f8032ccf596d0eedb5ab6797 Mon Sep 17 00:00:00 2001
From: Nick Daly <Nick.M.Daly@gmail.com>
Date: Thu, 28 Jun 2012 00:33:10 -0500
Subject: [PATCH] Properly escape output to prevent XSS.

---
 .../https/templates/html/consumedHost.tmpl          | 10 ++++++++--
 .../https/templates/html/consumedService.tmpl       | 13 ++++++++++---
 .../protocols/https/templates/html/consuming.tmpl   |  2 ++
 .../https/templates/html/hostedClient.tmpl          |  3 +++
 .../https/templates/html/hostedService.tmpl         |  4 ++++
 .../protocols/https/templates/html/hosting.tmpl     |  2 ++
 6 files changed, 29 insertions(+), 5 deletions(-)
diff --git a/ugly_hacks/santiago/protocols/https/templates/html/consumedHost.tmpl b/ugly_hacks/santiago/protocols/https/templates/html/consumedHost.tmpl
index 948a51305..a07b64d4d 100644
--- a/ugly_hacks/santiago/protocols/https/templates/html/consumedHost.tmpl
+++ b/ugly_hacks/santiago/protocols/https/templates/html/consumedHost.tmpl
@@ -1,3 +1,5 @@
+#import cgi
+#set $host = $cgi.escape($host)
 <html>
   <head>
     <style>
@@ -7,11 +9,15 @@
     </style>
   </head>
   <body>
-    <p>You are <a href="/consuming">consuming</a> services from $host:</p>
+    <p>You are <a href="/consuming">consuming</a> services from
+      $host:</p>
     #if $services
     <ul>
       #for $service in $services
-      <li><a href="/consuming/$host/$service">$service</a>
+      #set $service = $cgi.escape($service)
+      <li>
+        <a href="/consuming/$host/$service">
+          $service</a>
         <form method="post" action="/consuming/$host">
           <input type="hidden" name="delete" value="$service" />
           <input type="submit" value="Delete" />
diff --git a/ugly_hacks/santiago/protocols/https/templates/html/consumedService.tmpl b/ugly_hacks/santiago/protocols/https/templates/html/consumedService.tmpl
index 705bd9dc6..64dad8284 100644
--- a/ugly_hacks/santiago/protocols/https/templates/html/consumedService.tmpl
+++ b/ugly_hacks/santiago/protocols/https/templates/html/consumedService.tmpl
@@ -1,3 +1,6 @@
+#import cgi
+#set $host = $cgi.escape($host)
+#set $service = $cgi.escape($service)
 <html>
   <head>
     <style>
@@ -12,8 +15,11 @@
     #if $locations
     <ul>
       #for $location in $locations
-      <li><a href="$location">$location</a>
-        <form method="post" action="/consuming/$host/$service">
+      #set $location = $cgi.escape($location)
+      <li>
+        <a href="$location">$location</a>
+        <form method="post" 
+              action="/consuming/$host/$service">
           <input type="hidden" name="delete" value="$location" />
           <input type="submit" value="Delete" />
         </form>
@@ -22,7 +28,8 @@
     </ul>
     #end if
     <hr />
-    <form method="post" action="/consuming/$host/$service">
+    <form method="post" 
+          action="/consuming/$host/$service">
       <label>Location: <input name="put" /></label>
       <input type="submit" value="Create New Location" />
     </form>
diff --git a/ugly_hacks/santiago/protocols/https/templates/html/consuming.tmpl b/ugly_hacks/santiago/protocols/https/templates/html/consuming.tmpl
index 1e33fa319..6a176aa22 100644
--- a/ugly_hacks/santiago/protocols/https/templates/html/consuming.tmpl
+++ b/ugly_hacks/santiago/protocols/https/templates/html/consuming.tmpl
@@ -1,3 +1,4 @@
+#import cgi
 <html>
   <head>
     <style>
@@ -11,6 +12,7 @@
     #if $hosts
     <ul>
       #for $host in $hosts
+      #set $host = $cgi.escape($host)
       <li><a href="/consuming/$host">$host</a>
         <form method="post" action="/consuming">
           <input type="hidden" name="delete" value="$host" />
diff --git a/ugly_hacks/santiago/protocols/https/templates/html/hostedClient.tmpl b/ugly_hacks/santiago/protocols/https/templates/html/hostedClient.tmpl
index 7661d747f..3cbe1eff6 100644
--- a/ugly_hacks/santiago/protocols/https/templates/html/hostedClient.tmpl
+++ b/ugly_hacks/santiago/protocols/https/templates/html/hostedClient.tmpl
@@ -1,3 +1,5 @@
+#import cgi
+#set $client = $cgi.escape($client)
 <html>
   <head>
     <style>
@@ -11,6 +13,7 @@
     #if $services
     <ul>
       #for $service in $services
+      #set $service = $cgi.escape(service)
       <li><a href="/hosting/$client/$service">$service</a>
         <form method="post" action="/hosting/$client">
           <input type="hidden" name="delete" value="$service" />
diff --git a/ugly_hacks/santiago/protocols/https/templates/html/hostedService.tmpl b/ugly_hacks/santiago/protocols/https/templates/html/hostedService.tmpl
index fa51ae869..bbead713c 100644
--- a/ugly_hacks/santiago/protocols/https/templates/html/hostedService.tmpl
+++ b/ugly_hacks/santiago/protocols/https/templates/html/hostedService.tmpl
@@ -1,3 +1,6 @@
+#import cgi
+#set $client = $cgi.escape($client)
+#set $service = $cgi.escape($service)
 <html>
   <head>
     <style>
@@ -12,6 +15,7 @@
     #if $locations
     <ul>
       #for $location in $locations
+      #set $location = $cgi.escape($location)
       <li><a href="$location">$location</a>
         <form method="post" action="/hosting/$client/$service">
           <input type="hidden" name="delete" value="$location" />
diff --git a/ugly_hacks/santiago/protocols/https/templates/html/hosting.tmpl b/ugly_hacks/santiago/protocols/https/templates/html/hosting.tmpl
index db0b51926..ab3596bfe 100644
--- a/ugly_hacks/santiago/protocols/https/templates/html/hosting.tmpl
+++ b/ugly_hacks/santiago/protocols/https/templates/html/hosting.tmpl
@@ -1,3 +1,4 @@
+#import cgi
 <html>
   <head>
     <style>
@@ -11,6 +12,7 @@
     <p>You are hosting services for:</p>
     <ul>
       #for $client in $clients
+      #set $client = $cgi.escape($client)
       <li><a href="/hosting/$client">$client</a>
         <form method="post" action="/hosting">
           <input type="hidden" name="delete" value="$client" />
