diff --git a/kb/api/base.py b/kb/api/base.py index e65cead..d705a31 100644 --- a/kb/api/base.py +++ b/kb/api/base.py @@ -14,6 +14,7 @@ from typing import Dict from flask import make_response +from markupsafe import escape from kb.actions.base import base_list,get_current_kb_details,does_base_exist,switch_base from kb.api.constants import MIME_TYPE @@ -38,9 +39,9 @@ def base(config: Dict[str, str]): def switch(target:str, config: Dict[str, str]): if does_base_exist(target,config): switch_base(target,config) - resp = (make_response(({'Switched': "The current knowledge base is now : '" + target + "'"}), 200)) + resp = (make_response(({'Switched': "The current knowledge base is now : '" + escape(target) + "'"}), 200)) else: - resp = (make_response(({'Error': "The knowledge base '" + target + "' does not exist"}), 404)) + resp = (make_response(({'Error': "The knowledge base '" + escape(target) + "' does not exist"}), 404)) resp.mimetype = MIME_TYPE['json'] return resp diff --git a/kb/api/template.py b/kb/api/template.py index aa942dc..e9d1841 100644 --- a/kb/api/template.py +++ b/kb/api/template.py @@ -17,6 +17,7 @@ from typing import Dict from flask import jsonify, make_response +from markupsafe import escape from kb.actions.template import get_template as get_a_template from kb.actions.template import delete as delete_template @@ -196,7 +197,7 @@ def get_template(template, DEFAULT_CONFIG): resp.mimetype = MIME_TYPE['json'] return(resp) else: - record = '{"Template":"' + template + '","Content":"' + str(results) + '"}' + record = '{"Template":"' + escape(template) + '","Content":"' + escape(str(results)) + '"}' resp = (make_response((record), 200)) resp.mimetype = MIME_TYPE['utf8'] return(resp) diff --git a/kb/api/view.py b/kb/api/view.py index 022d052..518dc1f 100644 --- a/kb/api/view.py +++ b/kb/api/view.py @@ -16,6 +16,7 @@ from pathlib import Path from flask import make_response +from markupsafe import escape from kb.api.constants import MIME_TYPE from kb.db import get_artifact_by_id, get_artifacts_by_filter @@ -41,7 +42,7 @@ def view_by_id(conn, id, DEFAULT_CONFIG): if id: artifact = get_artifact_by_id(conn, id) if artifact is None: - response = make_response(({'Error': 'There is no artifact with the ID of ' + str(id)}), 404) + response = make_response(({'Error': 'There is no artifact with the ID of ' + escape(str(id))}), 404) response.mimetype = MIME_TYPE['json'] return response category_path = Path(str(DEFAULT_CONFIG["PATH_KB_DATA"]), str(artifact.category)) @@ -71,13 +72,13 @@ def view_by_title(conn, title, DEFAULT_CONFIG): artifact = get_artifacts_by_filter(conn, title=title, is_strict=True) # Set default response - nothing found - response = (make_response(({'Error': 'There are no artifacts with the title of ' + title}), 404)) + response = (make_response(({'Error': 'There are no artifacts with the title of ' + escape(title)}), 404)) if len(artifact) > 1: - response = make_response(({'Error': 'There is more than one artifact with the title of ' + title}), 301) + response = make_response(({'Error': 'There is more than one artifact with the title of ' + escape(title)}), 301) response.mimetype = MIME_TYPE['json'] if len(artifact) == 0: - response = (make_response(({'Error': 'There are no artifacts with the title of ' + title}), 404)) + response = (make_response(({'Error': 'There are no artifacts with the title of ' + escape(title)}), 404)) response.mimetype = MIME_TYPE['json'] if len(artifact) == 1: category_path = Path(str(DEFAULT_CONFIG["PATH_KB_DATA"]), artifact[0].category) @@ -106,13 +107,13 @@ def view_by_name(conn, title, category, DEFAULT_CONFIG): """ artifact = get_artifacts_by_filter(conn, title=title, category=category, is_strict=True) # Set default response - nothing found - response = (make_response(({'Error': 'There are no artifacts with the name of ' + category + "/" + title}), 404)) + response = (make_response(({'Error': 'There are no artifacts with the name of ' + escape(category) + "/" + escape(title)}), 404)) if len(artifact) > 1: - response = make_response(({'Error': 'There is more than one artifact with the name of ' + category + "/" + title}), 301) + response = make_response(({'Error': 'There is more than one artifact with the name of ' + escape(category) + "/" + escape(title)}), 301) response.mimetype = MIME_TYPE['json'] if len(artifact) == 0: - response = (make_response(({'Error': 'There are no artifacts with the name of ' + category + "/" + title}), 404)) + response = (make_response(({'Error': 'There are no artifacts with the name of ' + escape(category) + "/" + escape(title)}), 404)) response.mimetype = MIME_TYPE['json'] if len(artifact) == 1: category_path = Path(str(DEFAULT_CONFIG["PATH_KB_DATA"]), artifact[0].category)