deepcrayon/buildroot
deepcrayon/buildroot
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

package/janus-gateway: fix CVE-2021-4124

Browse source 
janus-gateway is vulnerable to Improper Neutralization of Input During
Web Page Generation ('Cross-site Scripting')

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Fabrice Fontaine 2021-12-22 10:09:51 +01:00 committed by Peter Korsgaard
parent ffb2b79004
commit 2fd3c2cf43
2 changed files with 28 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
package/janus-gateway/0004-Fixed-missing-XSS-mitigation.patch Normal file
View file

@ -0,0 +1,25 @@
From f62bba6513ec840761f2434b93168106c7c65a3d Mon Sep 17 00:00:00 2001
From: Lorenzo Miniero <lminiero@gmail.com>
Date: Wed, 15 Dec 2021 14:10:01 +0100
Subject: [PATCH] Fixed missing XSS mitigation (see #2817)
[Retrieved from:
https://github.com/meetecho/janus-gateway/commit/f62bba6513ec840761f2434b93168106c7c65a3d]
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
html/textroomtest.js | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/html/textroomtest.js b/html/textroomtest.js
index bf95a260a..7d5ae832c 100644
--- a/html/textroomtest.js
+++ b/html/textroomtest.js
@@ -351,7 +351,7 @@ function sendPrivateMsg(username) {
text: JSON.stringify(message),
error: function(reason) { bootbox.alert(reason); },
success: function() {
- $('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + result);
+ $('#chatroom').append('<p style="color: purple;">[' + getDateString() + '] <b>[whisper to ' + display + ']</b> ' + escapeXmlTags(result));
$('#chatroom').get(0).scrollTop = $('#chatroom').get(0).scrollHeight;
}
});

3
package/janus-gateway/janus-gateway.mk
View file

@ -14,6 +14,9 @@ JANUS_GATEWAY_CPE_ID_PRODUCT = janus
# 0003-Fix-potential-Cross-site-Scripting-XSS-exploits-in-demos.patch
JANUS_GATEWAY_IGNORE_CVES += CVE-2021-4020
# 0004-Fixed-missing-XSS-mitigation.patch
JANUS_GATEWAY_IGNORE_CVES += CVE-2021-4124
# ding-libs provides the ini_config library
JANUS_GATEWAY_DEPENDENCIES = host-pkgconf jansson libnice \
libsrtp host-gengetopt libglib2 openssl libconfig \