admin/kubesphere
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sanitizer error message to avoid emitting xss error message (#2712)

Browse Source 
Signed-off-by: Jeff <zw0948@gmail.com>
This commit is contained in:
zryfish
2020-07-30 17:45:29 +08:00
committed by GitHub
parent 67c6a8c510
commit 114fad5eb0
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/api/utils.go
View File

@@ -21,35 +21,39 @@ import (
"k8s.io/klog"
"net/http"
"runtime"
"strings"
)
// Avoid emitting errors that look like valid HTML. Quotes are okay.
var sanitizer = strings.NewReplacer(`&`, "&amp;", `<`, "&lt;", `>`, "&gt;")
func HandleInternalError(response *restful.Response, req *restful.Request, err error) {
_, fn, line, _ := runtime.Caller(1)
klog.Errorf("%s:%d %v", fn, line, err)
_ = response.WriteError(http.StatusInternalServerError, err)
http.Error(response, sanitizer.Replace(err.Error()), http.StatusInternalServerError)
}
// HandleBadRequest writes http.StatusBadRequest and log error
func HandleBadRequest(response *restful.Response, req *restful.Request, err error) {
_, fn, line, _ := runtime.Caller(1)
klog.Errorf("%s:%d %v", fn, line, err)
_ = response.WriteError(http.StatusBadRequest, err)
http.Error(response, sanitizer.Replace(err.Error()), http.StatusBadRequest)
}
func HandleNotFound(response *restful.Response, req *restful.Request, err error) {
_, fn, line, _ := runtime.Caller(1)
klog.Errorf("%s:%d %v", fn, line, err)
_ = response.WriteError(http.StatusNotFound, err)
http.Error(response, sanitizer.Replace(err.Error()), http.StatusNotFound)
}
func HandleForbidden(response *restful.Response, req *restful.Request, err error) {
_, fn, line, _ := runtime.Caller(1)
klog.Errorf("%s:%d %v", fn, line, err)
_ = response.WriteError(http.StatusForbidden, err)
http.Error(response, sanitizer.Replace(err.Error()), http.StatusForbidden)
}
func HandleConflict(response *restful.Response, req *restful.Request, err error) {
_, fn, line, _ := runtime.Caller(1)
klog.Errorf("%s:%d %v", fn, line, err)
_ = response.WriteError(http.StatusConflict, err)
http.Error(response, sanitizer.Replace(err.Error()), http.StatusConflict)
}