[mapserver-commits] [MapServer/MapServer] 2e4229: WMS OpenLayers output: escape angle brackets in ma...

[Even Rouault]

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: 2e4229ff66f6eac1b270755a0ce0ce8debee4432
      https://github.com/MapServer/MapServer/commit/2e4229ff66f6eac1b270755a0ce0ce8debee4432
  Author: MarkLee131 <kaixuan.li at ntu.edu.sg>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M msautotest/pymod/mstestlib.py
    A msautotest/wxs/expected/wms_openlayers_xss.txt
    A msautotest/wxs/wms_openlayers_xss.map
    M src/maptemplate.c

  Log Message:
  -----------
  WMS OpenLayers output: escape angle brackets in mapserv_onlineresource

The GHSA-xqj6-vjqr-33vv fix only escaped the JS quote, so a literal
</script> in a forwarded host/proto header still closed the <script>
block. Encode the angle brackets as their JavaScript unicode escapes
so the value stays a JS string and cannot break out of the element.

Add a msautotest case (wxs/wms_openlayers_xss) and make the [ENV ...]
test directive repeatable so it can set the request headers it needs.


  Commit: 45c2283bee0bddd250ca60e48a142f74de55d8fe
      https://github.com/MapServer/MapServer/commit/45c2283bee0bddd250ca60e48a142f74de55d8fe
  Author: Even Rouault <even.rouault at spatialys.com>
  Date:   2026-07-07 (Tue, 07 Jul 2026)

  Changed paths:
    M msautotest/pymod/mstestlib.py
    A msautotest/wxs/expected/wms_openlayers_xss.txt
    A msautotest/wxs/wms_openlayers_xss.map
    M src/maptemplate.c

  Log Message:
  -----------
  Merge pull request #7544 from MarkLee131/fix-openlayers-xss-script-breakout

WMS OpenLayers output: escape angle brackets in mapserv_onlineresource


Compare: https://github.com/MapServer/MapServer/compare/f9d60f9a4f50...45c2283bee0b

To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications