main/monit/CVE-2019-11454.patch


1
2
3
4
5
6
7
8
9
10
11
12
13

diff --git a/src/http/cervlet.c b/src/http/cervlet.c
index dd822d8..b3ba3de 100644
--- a/src/http/cervlet.c
+++ b/src/http/cervlet.c
@@ -903,7 +903,7 @@ static void do_viewlog(HttpRequest req, HttpResponse res) {
                                 StringBuffer_append(res->outputbuffer, "<br><p><form><textarea cols=120 rows=30 readonly>");
                                 while ((n = fread(buf, sizeof(char), BUFSIZE, f)) > 0) {
                                         buf[n] = 0;
-                                        StringBuffer_append(res->outputbuffer, "%s", buf);
+                                        escapeHTML(res->outputbuffer, buf);
                                 }
                                 fclose(f);
                                 StringBuffer_append(res->outputbuffer, "</textarea></form>");