Do not test empty values for XSS

2011-05-30 15:34:43 +00:00 · 2011-05-30 15:34:43 +00:00 · 068dd9d46f
commit 068dd9d46f
parent ba55e25844
1 changed files with 4 additions and 0 deletions
--- a/modules/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Simple.pm
+++ b/modules/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Simple.pm
@ -686,6 +686,10 @@ sub buildHiddenForm {
 sub checkXSSAttack {
    my ( $self, $name, $value ) = splice @_;

+    # Empty values are not bad
+    return 0 unless $value;
+
+    # Test value
    if ( $value =~ m/(?:\0|<|'|"|`|\%(?:00|25|3C|22|27|2C))/ ) {
        $self->lmLog( "XSS attack detected (param: $name | value: $value)",
            "warn" );