From 412c5ce749d2dd66b70b276314e46f0c0518ff1e Mon Sep 17 00:00:00 2001 From: Yogesh Ojha Date: Mon, 23 Aug 2021 12:25:55 +0530 Subject: [PATCH] Fixed #459 #460 XSS --- .github/SECURITY.md | 4 ++++ web/scanEngine/static/scanEngine/js/custom_scan_engine.js | 4 ++-- web/scanEngine/templates/scanEngine/index.html | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/SECURITY.md b/.github/SECURITY.md index be9064a00..b8c8849fe 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -11,9 +11,13 @@ Please report all security issues [here](https://github.com/yogeshojha/rengine/i ## Past Security Vulnerabilities * [Stored XSS](https://github.com/yogeshojha/rengine/issues/178) on Detail Scan Page via Page Title Parameter, Reported by [omemishra](https://github.com/omemishra) + * [Stored XSS](https://github.com/yogeshojha/rengine/issues/347) on Vulnerability Scan page via URL Parameter, Reported by [Arif Khan, payloadartist](https://twitter.com/payloadartist) +* Several Instances of XSS in reNgine 1.0 (#460, #459, #458, #457, #456, #455), Reported by [Binit Ghimire](https://github.com/TheBinitGhimire) + **reNgine thanks the following people for making a responsible disclosure and helping the community make reNgine safer!** * [onemishra](https://github.com/omemishra) * [Arif Khan, payloadartist](https://twitter.com/payloadartist) +* [Binit Ghimire](https://github.com/TheBinitGhimire) diff --git a/web/scanEngine/static/scanEngine/js/custom_scan_engine.js b/web/scanEngine/static/scanEngine/js/custom_scan_engine.js index 5b8b66923..17c122670 100644 --- a/web/scanEngine/static/scanEngine/js/custom_scan_engine.js +++ b/web/scanEngine/static/scanEngine/js/custom_scan_engine.js @@ -20,11 +20,11 @@ $(document).ready(function() { } ); -function delete_api(id, name, item) +function delete_api(id, item) { var delAPI = 'delete/'+id; swal.queue([{ - title: 'Are you sure you want to delete '+ jsEscape(name) +'?', + title: 'Are you sure you want to delete this scan engine?', text: "You won't be able to revert this!", type: 'warning', showCancelButton: true, diff --git a/web/scanEngine/templates/scanEngine/index.html b/web/scanEngine/templates/scanEngine/index.html index 75eb3ef06..f5e9d2046 100644 --- a/web/scanEngine/templates/scanEngine/index.html +++ b/web/scanEngine/templates/scanEngine/index.html @@ -111,7 +111,7 @@
Scan Engines
- +