Browse Source

fix(title-xss): escaping text acquired from parameters to avoid any xss attacks

https://github.com/Netflix/Hystrix/pull/921
pull/6/head
Spencer Gibb 10 years ago
parent
commit
0df6f0c0ae
  1. 4
      spring-cloud-netflix-hystrix-dashboard/src/main/resources/templates/hystrix/monitor.ftl

4
spring-cloud-netflix-hystrix-dashboard/src/main/resources/templates/hystrix/monitor.ftl

@ -101,9 +101,9 @@ @@ -101,9 +101,9 @@
var poolStream = "${contextPath}/proxy.stream?origin=" + stream;
if(getUrlVars()["title"] != undefined) {
$('#title_name').html("Hystrix Stream: " + decodeURIComponent(getUrlVars()["title"]))
$('#title_name').text("Hystrix Stream: " + decodeURIComponent(getUrlVars()["title"]))
} else {
$('#title_name').html("Hystrix Stream: " + decodeURIComponent(stream))
$('#title_name').text("Hystrix Stream: " + decodeURIComponent(stream))
}
}
console.log("Command Stream: " + commandStream)

Loading…
Cancel
Save