← Back to branch summary

~tribaal/txaws/xss-hardening

« back to all changes in this revision

Viewing changes to txaws/server/resource.py

  • Committer: Christopher Glass
  • Date: 2013-08-15 11:14:55 UTC
  • Revision ID: christopher.glass@canonical.com-20130815111455-dckrxs9ppj7tev7h
HTML escape values then raising errors to prevent malicious users from tricking
legitimate users into accessing an error URL crafted with executable code.

Show diffs side-by-side

added added

removed removed

Lines of Context:
txaws/server/resource.py
 
1
from cgi import escape
 
2
 
1
3
from datetime import datetime, timedelta
2
4
from uuid import uuid4
3
5
from dateutil.tz import tzutc
109
111
                    log.msg("status: %s message: %s" % (
110
112
                        status, safe_str(failure.value)))
111
113
 
112
 
                bytes = failure.value.response
113
 
                if bytes is None:
114
 
                    bytes = self.dump_error(failure.value, request)
 
114
                body = failure.value.response
 
115
                if body is None:
 
116
                    body = self.dump_error(failure.value, request)
115
117
            else:
116
118
                log.err(failure)
117
 
                bytes = safe_str(failure.value)
 
119
                body = safe_str(failure.value)
118
120
                status = 500
119
121
            request.setResponseCode(status)
120
122
            request.setHeader("Content-Type", self.content_type)
121
 
            request.write(bytes)
 
123
            request.write(escape(body))
122
124
            request.finish()
123
125
 
124
126
        deferred.addCallback(write_response)