Davi Frossard 5c36699fec Address XSS vulnerability in Data Network Creation
Add server-side validation to "name" field to prevent special
characters and reduce risk of HTML/SQL injection. Introduce escapeHtml
function in hosttopology.js to sanitize user input and prevent rendering
of malicious tags.

TEST-PLAN:
1. Log in to the StarlingX control panel as an administrator.
2. Navigate to **Admin -> Platform -> Data Networks**.
3. Click **Create Data Networks**.
4. Enter the following payload into the **Name** field:
`test<script>alert(document.domain)</script>`
5. Select any **Type**.
6. Click the **Create Data Networks** button.
Assert that it is not possible to create such Data Network.
7. Create the Data Network directly from CLI.
8. Log in as a different user.
9. Navigate to **Admin -> Platform -> Data Network Topology**.
Observe that there is no JavaScript alert box displaying the domain.

Closes-bug: 2103647
Change-Id: Ia2bd091eca6cdfdfc13b061cb895bcd5664f26e7
Signed-off-by: Davi Frossard <dbarrosf@windriver.com>
2025-04-14 19:56:06 +00:00
2018-09-25 05:44:57 -05:00
2019-04-19 19:52:27 +00:00
2023-09-08 19:21:28 -03:00
2019-11-12 17:21:02 -05:00
2018-09-24 22:26:46 +08:00
2018-05-20 20:53:11 -07:00
2023-05-01 14:01:17 +00:00
2023-05-01 14:01:17 +00:00
Description
StarlingX Horizon plugins for new StarlingX services
5.7 MiB
Languages
Python 72.5%
HTML 14.1%
JavaScript 12.5%
SCSS 0.8%
Makefile 0.1%