[mapserver-commits] [MapServer/MapServer] 57a5d5: WMS OpenLayers output: escape angle brackets in ma...

[MarkLee131]

  Branch: refs/heads/backport-7544-to-branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: 57a5d592a4270137c20f33459d59d370b5374426
      https://github.com/MapServer/MapServer/commit/57a5d592a4270137c20f33459d59d370b5374426
  Author: MarkLee131 <kaixuan.li at ntu.edu.sg>
  Date:   2026-07-07 (Tue, 07 Jul 2026)

  Changed paths:
    M msautotest/pymod/mstestlib.py
    A msautotest/wxs/expected/wms_openlayers_xss.txt
    A msautotest/wxs/wms_openlayers_xss.map
    M src/maptemplate.c

  Log Message:
  -----------
  WMS OpenLayers output: escape angle brackets in mapserv_onlineresource

The GHSA-xqj6-vjqr-33vv fix only escaped the JS quote, so a literal
</script> in a forwarded host/proto header still closed the <script>
block. Encode the angle brackets as their JavaScript unicode escapes
so the value stays a JS string and cannot break out of the element.

Add a msautotest case (wxs/wms_openlayers_xss) and make the [ENV ...]
test directive repeatable so it can set the request headers it needs.



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications