icao xss

adsblol · Aug 20, 2024 · 48bddd0 · 48bddd0
1 parent 05e86b3
commit 48bddd0
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/lua/inject_meta.lua b/lua/inject_meta.lua
@@ -3,8 +3,9 @@ local args = ngx.req.get_uri_args()
 if not args["icao"] then
     return
 end
+-- get icao arg, but escape it.
+local icao = ngx.escape_uri(args["icao"])
 
-local icao = args["icao"]
 local aircraft_types = require "aircraft_types"
 local icao_ranges = require "icao_ranges"