src/usr.bin/mandoc/man.cgi.8 - diff

Return to man.cgi.8 CVS log

Up to [local] / src / usr.bin / mandoc

Diff for /src/usr.bin/mandoc/man.cgi.8 between version 1.6 and 1.7

-version 1.6, 2014/07/21 15:44:22
+version 1.7, 2014/07/22 18:14:05
 Line 267
 Line 267
 Line 267
  is supported as an alias for
  .Cm sec .
  .El
+ .Ss Restricted character set
+ For security reasons, in particular to prevent cross site scripting
+ attacks, some strings used by
+ .Nm
+ can only contain the following characters:
+ .Pp
+ .Bl -dash -compact -offset indent
+ .It
+ lower case and upper case ASCII letters
+ .It
+ the ten decimal digits
+ .It
+ the dash
+ .Pq Sq -
+ .It
+ the dot
+ .Pq Sq \&.
+ .It
+ the slash
+ .Pq Sq /
+ .It
+ the underscore
+ .Pq Sq _
+ .El
+ .Pp
+ In particular, this applies to the
+ .Ev SCRIPT_NAME ,
+ to all manpaths, and to all architecture names.
  .Sh ENVIRONMENT
  The web server may pass the following CGI variables to
  .Nm :
-Line 293
+Line 321
 Line 293
 Line 321
  .Pa /cgi-bin/man.cgi .
  This is used for generating URIs to be embedded
  in generated HTML code and HTTP headers.
+ If this contains any character not contained in the
+ .Sx Restricted character set ,
+ .Nm
+ reports an internal server error and exits without doing anything.
  .El
  .Sh FILES
  .Bl -tag -width Ds
-Line 332
+Line 364
 Line 332
 Line 364
  itself, linked from the index page.
  .It Pa /man/manpath.conf
  The list of available manpaths, one per line.
+ If any of the lines in this file contains a slash
+ .Pq Sq /
+ or any character not contained in the
+ .Sx Restricted character set ,
+ .Nm
+ reports an internal server error and exits without doing anything.
  .It Pa /man/OpenBSD-current/man1/mandoc.1
  An example
  .Xr mdoc 7