wwbmmm opened a new pull request, #3529: URL: https://github.com/apache/brpc/pull/3529
### What problem does this PR solve? Problem Summary: The builtin `/flags` service wrote the gflag name and value into the HTML page without escaping in two places: the `?setvalue=` confirmation message and the `?setvalue&withform` form page (`set_value_page`). Unlike the flag list page, which already escapes values with `HtmlReplace`, these two sinks rendered the raw value, so a value containing HTML metacharacters was injected into the page markup. ### What is changed and the side effects? Changed: - Escape the flag name and `current_value` in `set_value_page` with `WebEscape`. - Escape the flag name and the new value in the `?setvalue=` confirmation message with `WebEscape`. Side effects: - Performance effects: none, only affects HTML rendering of the `/flags` pages. - Breaking backward compatibility: none. Plain-text output (non-browser requests) is unchanged. --- ### Check List: - Added `BuiltinServiceTest.flags_escaping` covering the reflected (`?setvalue=<payload>`) and stored (`?setvalue&withform`) HTML rendering plus the unchanged plain-text output; the test uses a reloadable string gflag and restores its value afterwards. - Full `test/brpc_builtin_service_unittest` passes (20 tests). --- 🤖 This PR was automatically created by brpc-oncall -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
