Hi Willy, -- I prefer encrypted and signed messages. Fingerprint: 110A F423 3647 54E2 880F ADAD 1C52 85BF B20A 22F9
No trees were harmed in the sending of this message, however, a number of electrons were inconvenienced. > On 2 Jan 2017, at 10:45, Willy Tarreau <[email protected]> wrote: > > Hi David, > > On Sun, Jan 01, 2017 at 12:37:33PM +0000, David Harrigan wrote: >> Happy New Year and thank you for your feedback. >> >> I think my patch may be safe, it's a one liner of JS. However, I do have to >> reference >> the server names somewhere, and I do that by obtaining the contents of the >> px-id >> (and ST_F_PXNAME) variables. >> >> What do you think? The patch may be dangerous? (I'm not that clued up on >> JS injection tbh). I would be happy to use a different way if you can suggest >> something? > > We need to check the exact alphabet which is allowed for server names and/or > if we currently encode it when dumping it in the HTML stats output. Hmmm I've > just checked and we currently dump it as-is. The only allowed characters are > [A-Za-z0-9_:.-] so that's fine, you won't unescape a string nor produce HTML > contents with this. That's great! I'm glad it appears to be safe. Is there anything else you would like me to do, or is it in reasonably good shape to be included as a patch into 1.8 (possibly backported as well?) Thank you kindly. -=david=- > >> Luckily, if JS is disabled on the browser, the "select all" checkbox won't do >> anything :-) > > That's indeed the goal ;-) :-) > > Willy
