test: print ip address #14693
test: print ip address #14693
Conversation
Demo
Jenkins 
demos.haus ![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| f""" | ||
| ip: {flask.request.remote_addr}, | ||
| forwared-ip: {flask.request.environ.get("HTTP_X_FORWARDED_FOR")}, | ||
| remote-ip: {flask.request.environ.get("REMOTE_ADDR")} | ||
| """ |
Check warning
Code scanning / CodeQL
Reflected server-side cross-site scripting Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 7 days ago
To fix the problem, we need to escape the user-provided input before including it in the response. The html.escape() function from the standard library can be used to escape special characters in the user input, making it safe to include in the HTML response.
We will modify the testip function to use html.escape() to sanitize the user-provided input before including it in the response. This will prevent any potential XSS attacks by ensuring that special characters are properly escaped.
| @@ -1227,7 +1227,11 @@ | ||
| def testip(): | ||
| from html import escape | ||
| remote_addr = escape(flask.request.remote_addr or "") | ||
| forwarded_ip = escape(flask.request.environ.get("HTTP_X_FORWARDED_FOR", "")) | ||
| remote_ip = escape(flask.request.environ.get("REMOTE_ADDR", "")) | ||
| resp = flask.Response( | ||
| f""" | ||
| ip: {flask.request.remote_addr}, | ||
| forwared-ip: {flask.request.environ.get("HTTP_X_FORWARDED_FOR")}, | ||
| remote-ip: {flask.request.environ.get("REMOTE_ADDR")} | ||
| ip: {remote_addr}, | ||
| forwared-ip: {forwarded_ip}, | ||
| remote-ip: {remote_ip} | ||
| """ |
Done