diff --git a/js/privatebin.js b/js/privatebin.js index c83d8ffb..5c0aeccb 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -620,6 +620,9 @@ jQuery.PrivateBin = (function($, RawDeflate) { // messageID may contain links, but only the first parameter, as that is from a trusted source (code or translation JSON files) let containsLinks = args[0].indexOf(' 0) { + throw new Error('security violation detected: do not concatenate links and untrusted data!'); + } // format string let output = Helper.sprintf.apply(this, args); diff --git a/test.diff b/test.diff new file mode 100644 index 00000000..97e384f2 --- /dev/null +++ b/test.diff @@ -0,0 +1,40 @@ +diff --git a/js/privatebin.js b/js/privatebin.js +index c83d8ff..5c0aecc 100644 +--- a/js/privatebin.js ++++ b/js/privatebin.js +@@ -620,6 +620,9 @@ jQuery.PrivateBin = (function($, RawDeflate) { + + // messageID may contain links, but only the first parameter, as that is from a trusted source (code or translation JSON files) + let containsLinks = args[0].indexOf(' 0) { ++ throw new Error('security violation detected: do not concatenate links and untrusted data!'); ++ } + + // format string + let output = Helper.sprintf.apply(this, args); +diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php +index 59c730e..0e949da 100644 +--- a/tpl/bootstrap.php ++++ b/tpl/bootstrap.php +@@ -72,7 +72,7 @@ endif; + ?> + + +- ++ + + + +diff --git a/tpl/page.php b/tpl/page.php +index 0f8df18..ff2d5f5 100644 +--- a/tpl/page.php ++++ b/tpl/page.php +@@ -50,7 +50,7 @@ endif; + ?> + + +- ++ + + + diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index 59c730e2..0e949da6 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -72,7 +72,7 @@ endif; ?> - + diff --git a/tpl/page.php b/tpl/page.php index 0f8df184..ff2d5f50 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -50,7 +50,7 @@ endif; ?> - +