diff options
| author | Michał Gołębiowski-Owczarek <m.goleb@gmail.com> | 2024-10-28 16:47:29 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-10-28 16:47:29 +0100 |
| commit | 85bed8ddd893390fd41bd7e93d2a44a1b5d9b885 (patch) | |
| tree | 025040a0e3d592dddfb9ca65208c6e65edea2eb7 /tests/runner/server.js | |
| parent | af8adca5481d0ac5db0865032b6c4c7e21421be7 (diff) | |
| download | jquery-ui-85bed8ddd893390fd41bd7e93d2a44a1b5d9b885.tar.gz jquery-ui-85bed8ddd893390fd41bd7e93d2a44a1b5d9b885.zip | |
Build: Fix an XSS in the test server HTML serving logic
The test server has a rule for `/tests/unit/*/*.html` paths that serves
a proper local file. However, the parameters after `/unit/` so far accepted
many characters that have special meaning, leading to possibly reading a file
from outside of the Git repository. Fix that by only accepting alphanumeric
characters, `-` or `_`.
This should resolve one CodeQL alert.
Closes gh-2309
Diffstat (limited to 'tests/runner/server.js')
0 files changed, 0 insertions, 0 deletions