From a08f59d42f3c62c91b92aa01e45c0917f313e022 Mon Sep 17 00:00:00 2001 From: zzz Date: Tue, 21 Nov 2023 07:45:57 -0500 Subject: [PATCH] Console: Don't list inner classes on /configlogging Because the $ won't get through the XSS filter --- .../src/net/i2p/router/web/helpers/ConfigLoggingHelper.java | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigLoggingHelper.java b/apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigLoggingHelper.java index 4376a8cf9..234b295e6 100644 --- a/apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigLoggingHelper.java +++ b/apps/routerconsole/java/src/net/i2p/router/web/helpers/ConfigLoggingHelper.java @@ -118,6 +118,9 @@ public class ConfigLoggingHelper extends HelperBase { for (Log log : logs) { String name = log.getName(); + // skip inner classes, the $ gets caught by the XSS filter + if (name.contains("$")) + continue; if (!limits.contains(name)) sortedLogs.add(name);