XSS via Host Header Injection about sinatra HOT 5 CLOSED

Thanks for the report. Do you have any suggestions what to do about it?

from sinatra.

Hello @dentarg,

I initially suggest the HTML escaping within the uri in this code snippet:

<img src='#{uri '/__sinatra__/404.png'}'>

from sinatra.

Yeah, I was thinking that and <img src='#{Rack::Utils.escape_html(uri('/__sinatra__/404.png'))}'> does work fine.

I was also thinking, why do we need to use uri at all here? So I looked in the git history, and found 238eede, the reason is "when running under a nested path"

...but why not use the same solution, SCRIPT_NAME, as for the 500 image? I did that in #1943

from sinatra.

Because by using the header X-Forwarded-Host we are able to change the Host Header and instead of a host, we write a Javascript payload.

from sinatra.

But yes, you can use the solution that you did in #1943

from sinatra.