arrfab / pagure

Forked from pagure 6 years ago
Clone
Source Code
GIT

66093b8 Do not serve svg inline

1 file Authored by Michael Scherer 6 years ago, Committed by pingou 6 years ago,
raw patch tree parent
1 file changed. 1 lines added. 1 lines removed.
pagure/lib/mimetype.py
file modified
+1 -1 
    Do not serve svg inline
    
    SVG can contain javascript, so that's a easy vector for XSS on pagure.
    
    Fix CVE-2018-1002155
    
    Signed-off-by: Michael Scherer <misc@redhat.com>
file modified
+1 -1
Powered by Pagure 5.14.1
Documentation • File an Issue • About • SSH Hostkey/Fingerprint
© Red Hat, Inc. and others.