Fix for XSS vulnerability

The not found url could be crafted with script and could be used for an XSS attack. If you use the notfound.aspx (instead of redirecting to a page), you can just change that with this new version.
Geta · Oct 31, 2017 · 02419c9 · 02419c9 · jmburnz · May 29, 2022
1 parent c03a6be
commit 02419c9
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/src/NotFound.aspx b/src/NotFound.aspx
@@ -133,9 +133,8 @@
             <%= Content.TopText %>
             <%= Content.LookingFor %>
             <div class="notfoundbox">
-                <%= UrlNotFound %>
+                <%= HttpUtility.HtmlEncode(UrlNotFound.ToString()) %>
                 <%= Referer.Length > 0 ? Content.CameFrom : "" %>
-                <%= Referer.Length > 0 ? Referer : "" %>
             </div>
             <%= Content.BottomText %>
         </div>