Loading...

XML

Word

Printable

Type: Bug
Resolution: Done
Priority: Normal
Fix Version/s: 4.18.0
Affects Version/s: 4.14.z, 4.15.z, 4.17.z, 4.16.z, 4.18.0
Component/s: HyperShift
Labels:
- no-qe
- snyk
- triaged

Activity Type:
Quality / Stability / Reliability
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Story Points:
None
Severity:
None
Regression:
None

Target Backport Versions:
None
Target Version:

4.18.0
Release Blocker:
None
Sprint:
Hypershift Sprint 259
sprint_count:
1

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

Release Note Status:
None
Release Note Type:
None
Release Note Text:
None

Escape Reason:
None
Escape Impact:
None
Corrective Measures:
None
SDLC stage when should've been found:
None

Error from SNYK code:

https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_release/56687/rehearse-56687-pull-ci-openshift-hypershift-main-security/1834567227643269120

✗ [High] Cross-site Scripting (XSS) 
  Path: ignition-server/cmd/start.go, line 250 
  Info: Unsanitized input from an HTTP header flows into Write, where it is used to render an HTML page returned to the user. This may result in a Reflected Cross-Site Scripting attack (XSS).

is cloned by

OCPBUGS-41982 [SNYK] Unsanitized input from a CLI argument flows into os.ReadFile and os.WriteFile

Closed

OCPBUGS-41992 Perform a better sanitisation from the input into IgnitionServer from HTTP header

Closed

links to

openshift/hypershift#4723: OCPBUGS-41935: Sanitize the IgnitionPayload (XSS)

Assignee:: Juan Manuel Parrilla Madrid

Reporter:: Juan Manuel Parrilla Madrid

Need Info From:: None

Contributors:: None

QA Contact:: Jie Zhao

Doc Contact:: None

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Created:: 2024/09/13 2:07 PM

Updated:: 2025/07/21 5:27 PM

Resolved:: 2024/09/16 9:11 AM