X-Git-Url: https://osm.etsi.org/gitweb/?p=osm%2FNBI.git;a=blobdiff_plain;f=osm_nbi%2Fhtml_out.py;h=316e15b41489d833811a731bc4b5a84dc0b07ef5;hp=b344aff8ff17ba6e1cf4500ef5434b75fd1b177d;hb=341ac1bac7b115d64a50ec166aa5e6d186b39443;hpb=8748af53c4e12a7034c9bc107c502c32c593aadf;ds=sidebyside

diff --git a/osm_nbi/html_out.py b/osm_nbi/html_out.py
index b344aff..316e15b 100644
--- a/osm_nbi/html_out.py
+++ b/osm_nbi/html_out.py
@@ -153,9 +153,11 @@ def format(data, request, response, toke_info):
             return html_auth2.format(error=data)
     if request.path_info in ("/version", "/system"):
         return "<pre>" + yaml.safe_dump(data, explicit_start=False, indent=4, default_flow_style=False) + "</pre>"
-    body = html_body.format(item=request.path_info)
+    body = html_body.format(item=html_escape(request.path_info))
     if response.status and response.status > 202:
-        body += html_body_error.format(yaml.safe_dump(data, explicit_start=True, indent=4, default_flow_style=False))
+        # input request.path_info (URL) can contain XSS that are translated into output error detail
+        body += html_body_error.format(html_escape(
+            yaml.safe_dump(data, explicit_start=True, indent=4, default_flow_style=False)))
     elif isinstance(data, (list, tuple)):
         if request.path_info == "/vnfpkgm/v1/vnf_packages":
             body += html_upload_body.format(request.path_info + "_content", "VNFD")