encode/django-rest-framework
1
1
Fork 0
mirror of https://github.com/encode/django-rest-framework.git synced 2025-08-01 19:10:12 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix XSS in default DRF Browsable API template by re-enabling autoescape

Browse Source
This commit is contained in:
Yury V. Zaytsev 2018-12-14 17:57:41 +01:00
parent 343ce4a03c
commit 75a489150a
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
rest_framework/templates/rest_framework/base.html
View File

@ -171,10 +171,10 @@
</div>
<div class="response-info" aria-label="{% trans "response info" %}">
<pre class="prettyprint"><span class="meta nocode"><b>HTTP {{ response.status_code }} {{ response.status_text }}</b>{% autoescape off %}{% for key, val in response_headers|items %}
<pre class="prettyprint"><span class="meta nocode"><b>HTTP {{ response.status_code }} {{ response.status_text }}</b>{% for key, val in response_headers|items %}
<b>{{ key }}:</b> <span class="lit">{{ val|break_long_headers|urlize_quoted_links }}</span>{% endfor %}
</span>{{ content|urlize_quoted_links }}</pre>{% endautoescape %}
</span>{{ content|urlize_quoted_links }}</pre>
</div>
</div>