diff options
| author | Micael Karlberg <[email protected]> | 2011-11-09 18:22:49 +0100 |
|---|---|---|
| committer | Micael Karlberg <[email protected]> | 2011-11-09 18:22:49 +0100 |
| commit | a7b67af7d2db9a442bd28952cca3fc61e5f0f227 (patch) | |
| tree | 93c878e712e9309469e8f1c2de80548e21f1143b /lib/inets/src/http_lib/http_util.erl | |
| parent | f561a98a9b89738467b52ab5213562de753f6ad2 (diff) | |
| parent | 53b434e40047fc4e085f57412b4e2227faddf23b (diff) | |
| download | otp-a7b67af7d2db9a442bd28952cca3fc61e5f0f227.tar.gz otp-a7b67af7d2db9a442bd28952cca3fc61e5f0f227.tar.bz2 otp-a7b67af7d2db9a442bd28952cca3fc61e5f0f227.zip | |
[httpd] XSS prevention did not work for hex-encoded URL's.
OTP-9655
Merge branch 'bmk/inets/httpd/xss_when_erl_encoded/r14/OTP-9655' into bmk/inets/inets572_integration
Diffstat (limited to 'lib/inets/src/http_lib/http_util.erl')
| -rw-r--r-- | lib/inets/src/http_lib/http_util.erl | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/lib/inets/src/http_lib/http_util.erl b/lib/inets/src/http_lib/http_util.erl index 973600d7be..5b21170b78 100644 --- a/lib/inets/src/http_lib/http_util.erl +++ b/lib/inets/src/http_lib/http_util.erl @@ -206,9 +206,7 @@ timeout(Timeout, Started) -> html_encode(Chars) -> Reserved = sets:from_list([$&, $<, $>, $\", $', $/]), - lists:append(lists:map(fun(Char) -> - char_to_html_entity(Char, Reserved) - end, Chars)). + lists:append([char_to_html_entity(Char, Reserved) || Char <- Chars]). %%%======================================================================== |