mirrors/btcpayserver
1
0
Fork 0
mirror of https://github.com/btcpayserver/btcpayserver.git synced 2025-01-19 05:33:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix: HTML injection in payment request/posData/receiptData (Close #4678) (#4679)

Browse Source 
Co-authored-by: Dennis Reimann <mail@dennisreimann.de>
This commit is contained in:
Nicolas Dorier 2023-02-23 00:35:34 +09:00 committed by GitHub
parent e6a157a101
commit ddb125f458
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 28 additions and 78 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
BTCPayServer/Views/Shared/Bitcoin/BitcoinLikeMethodCheckoutNoScript.cshtml
View File

@ -1,6 +1,6 @@
@model PaymentModel
<div>
<p>To complete payment, please send <b>@Safe.Raw(Model.IsUnsetTopUp? "any amount of": Model.BtcDue) @Model.CryptoCode</b> to <b style="word-break: break-word;">@Model.BtcAddress</b></p>
<p>To complete payment, please send <b>@(Model.IsUnsetTopUp ? "any amount of" : Model.BtcDue) @Model.CryptoCode</b> to <b style="word-break: break-word;">@Model.BtcAddress</b></p>
<p>Time remaining: @Model.TimeLeft</p>
<p>
<a href="@Model.InvoiceBitcoinUrl" style="word-break: break-word;" rel="noreferrer noopener">@Model.InvoiceBitcoinUrl</a>

8
BTCPayServer/Views/Shared/Bitcoin/ViewBitcoinLikePaymentData.cshtml
View File

@ -77,7 +77,13 @@
<td>@payment.Crypto</td>
<td>@(payment.CryptoPaymentData.KeyPath?.ToString()?? "Unknown")</td>
<td style="max-width:300px;" data-bs-toggle="tooltip" class="text-truncate" title="@payment.DepositAddress">@payment.DepositAddress</td>
<td class="payment-value">@payment.CryptoPaymentData.GetValue() @Safe.Raw(payment.AdditionalInformation is string i ? $"<br/>({i})" : string.Empty)</td>
<td class="payment-value">
@payment.CryptoPaymentData.GetValue()
@if (!string.IsNullOrEmpty(payment.AdditionalInformation))
{
<div>(@payment.AdditionalInformation)</div>
}
</td>
@if (hasNetworkFee)
{
<td>@payment.NetworkFee</td>

28
BTCPayServer/Views/Shared/PosData.cshtml
View File

@ -16,16 +16,16 @@
{
if (!string.IsNullOrEmpty(key))
{
<th class="w-150px">@Safe.Raw(key)</th>
<th class="w-150px">@key</th>
}
<td>
@if (IsValidURL(str))
{
<a href="@Safe.Raw(str)" target="_blank" rel="noreferrer noopener">@Safe.Raw(str)</a>
<a href="@str" target="_blank" rel="noreferrer noopener">@str</a>
}
else
{
@Safe.Raw(value?.ToString())
@value?.ToString()
}
</td>
}
@ -34,22 +34,26 @@
@* This is the array case *@
if (subItems.Count == 1 && subItems.First().Value is string str2)
{
<th class="w-150px">@Safe.Raw(key)</th>
<th class="w-150px">@key</th>
<td>
@if (IsValidURL(str2))
{
<a href="@Safe.Raw(str2)" target="_blank" rel="noreferrer noopener">@Safe.Raw(str2)</a>
<a href="@str2" target="_blank" rel="noreferrer noopener">@str2</a>
}
else
{
@Safe.Raw(subItems.First().Value?.ToString())
@subItems.First().Value?.ToString()
}
</td>
}
else
{
<td colspan="2" >
@Safe.Raw($"<h{Model.Level + 3} class=\"mt-4 mb-3\">{key}</h{Model.Level + 3}>")
</td>
}
else
{
<td colspan="2" >
@{
Write(Html.Raw($"<h{Model.Level + 3} class=\"mt-4 mb-3\">"));
Write(key);
Write(Html.Raw($"</h{Model.Level + 3}>"));
}
<partial name="PosData" model="(subItems, Model.Level + 1)"/>
</td>
}

60
BTCPayServer/Views/UIInvoice/PosData.cshtml
View File

@ -1,60 +0,0 @@
@model (Dictionary<string, object> Items, int Level)
@functions {
private bool IsValidURL(string source)
{
return Uri.TryCreate(source, UriKind.Absolute, out var uriResult) &&
(uriResult.Scheme == Uri.UriSchemeHttp || uriResult.Scheme == Uri.UriSchemeHttps);
}
}
<table class="table my-0">
@foreach (var (key, value) in Model.Items)
{
<tr>
@if (value is string str)
{
if (!string.IsNullOrEmpty(key))
{
<th class="w-150px">@Safe.Raw(key)</th>
}
<td>
@if (IsValidURL(str))
{
<a href="@Safe.Raw(str)" target="_blank" rel="noreferrer noopener">@Safe.Raw(str)</a>
}
else
{
@Safe.Raw(value?.ToString())
}
</td>
}
else if (value is Dictionary<string, object>subItems)
{
@* This is the array case *@
if (subItems.Count == 1 && subItems.First().Value is string str2)
{
<th class="w-150px">@Safe.Raw(key)</th>
<td>
@if (IsValidURL(str2))
{
<a href="@Safe.Raw(str2)" target="_blank" rel="noreferrer noopener">@Safe.Raw(str2)</a>
}
else
{
@Safe.Raw(subItems.First().Value?.ToString())
}
</td>
}
else
{
<td colspan="2" >
@Safe.Raw($"<h{Model.Level + 3} class=\"mt-4 mb-3\">{key}</h{Model.Level + 3}>")
<partial name="PosData" model="(subItems, Model.Level + 1)"/>
</td>
}
}
</tr>
}
</table>

8
BTCPayServer/Views/UILNURL/EditLightningAddress.cshtml
View File

@ -69,7 +69,7 @@
<div class="col-12 col-sm-auto">
<div class="form-group">
<label asp-for="Add.CurrencyCode" class="form-label"></label>
<input asp-for="Add.CurrencyCode" class="form-control" style="max-width:16ch;"/>
<input asp-for="Add.CurrencyCode" class="form-control w-auto" currency-selection style="max-width:16ch;"/>
<span asp-validation-for="Add.CurrencyCode" class="text-danger"></span>
</div>
</div>
@ -126,15 +126,15 @@
<td class="settings-holder align-middle">
@if (Model.Items[index].Min.HasValue)
{
<span>@Safe.Raw($"{Model.Items[index].Min} min sats")</span>
<span>@Model.Items[index].Min min sats</span>
}
@if (Model.Items[index].Max.HasValue)
{
<span> @Safe.Raw($"{Model.Items[index].Max} max sats")</span>
<span>@Model.Items[index].Max max sats</span>
}
@if (!string.IsNullOrEmpty(Model.Items[index].CurrencyCode))
{
<span> @Safe.Raw($"tracked in {Model.Items[index].CurrencyCode}")</span>
<span>tracked in @Model.Items[index].CurrencyCode</span>
}
</td>
<td class="text-end">