From 00e27fde395ef86da12db9ec12adf97aaaf8fd3b Mon Sep 17 00:00:00 2001 From: SomeRandomDeveloper Date: Mon, 18 Aug 2025 00:24:16 +0200 Subject: [PATCH] SECURITY: Escape filter values This fixes a stored XSS vulnerability. Bug: T402147 Change-Id: I93c2be20a518b4a1c31eb3100ca6a1b48d2eb5ee --- drilldown/CargoDrilldownPage.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drilldown/CargoDrilldownPage.php b/drilldown/CargoDrilldownPage.php index 6713f1b..2221dc1 100644 --- a/drilldown/CargoDrilldownPage.php +++ b/drilldown/CargoDrilldownPage.php @@ -347,7 +347,7 @@ END; preg_match( "/^~within_(.+)/", $value, $matches ); return $this->msg( 'cargo-drilldown-hierarchy-within', $matches[1] )->parse(); } else { - return $value; + return htmlspecialchars( $value, ENT_QUOTES ); } } -- 2.50.1