Skip to content

Commit

Permalink
Fix E_NOTICE when requesting invalid script (#449)
Browse files Browse the repository at this point in the history
It is possible to trigger an exception by requesting an invalid script path.

The following URL path leads to XSS on the exception page,
showing two nice popups:

  http://myapp/_ignition/scripts/--><svg onload=alert(1337)>

The exception is:

  ErrorException
  Undefined index: --><svg onload=alert(1337)>

  Illuminate\Foundation\Bootstrap\HandleExceptions::handleError
  vendor/facade/ignition/src/Http/Controllers/ScriptController.php:14

This happens with facade/ignition 1.18.0 (the last with laravel 6 support)
and should be fixed there.
The error probably also occurs in all later versions.
  • Loading branch information
cweiske committed Feb 23, 2022
1 parent 8f016e6 commit 1d71996
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions src/Http/Controllers/ScriptController.php
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,9 @@ class ScriptController
{
public function __invoke(Request $request)
{
if (!isset(Ignition::scripts()[$request->script])) {
abort(404, 'Script not found');
}
return response(
file_get_contents(
Ignition::scripts()[$request->script]
Expand Down

0 comments on commit 1d71996

Please sign in to comment.