Repository: thecoshman/http (language: rust)

Issue:
🚨 Potential Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
👋 Hello, @thecoshman - a potential medium severity Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in your repository has been disclosed to us.

#### Next Steps

1️⃣  Visit **https://huntr.dev/bounties/1-other-thecoshman/http** for more advisory information.

2️⃣  **[Sign-up](https://huntr.dev/)** to validate or speak to the researcher for more assistance.

3️⃣ Propose a patch or outsource it to our community - whoever fixes it gets paid.

---

#### Confused or need more help?

- Join us on our **[Discord](https://huntr.dev/discord)** and a member of our team will be happy to help! 🤗

- Speak to a member of our team: @JamieSlome

---

*This issue was automatically generated by [huntr.dev](https://huntr.dev) - a bug bounty board for securing open source code.*


Discussion / hints:
an attacker that.... has write access to the server? i mean, sure, it looks bad, but that's a tad inflated

Fix patch:
diff --git a/Cargo.toml b/Cargo.toml
index f2ed2f1..7a743cd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,7 +9,7 @@ categories = ["network-programming", "web-programming::http-server"]
 license = "MIT"
 build = "build.rs"
 # Remember to also update in appveyor.yml
-version = "1.12.0"
+version = "1.12.1"
 # Remember to also update in http.md
 authors = ["thecoshman <rust@thecoshman.com>",
            "nabijaczleweli <nabijaczleweli@nabijaczleweli.xyz>",
diff --git a/appveyor.yml b/appveyor.yml
index 5ce5104..1d63067 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -1,4 +1,4 @@
-version: 1.12.0-{build}
+version: 1.12.1-{build}
 
 skip_tags: false
 
@@ -33,21 +33,21 @@ build: off
 build_script:
   - git submodule update --init --recursive
   - cargo build --verbose --release
-  - cp target\release\http.exe http-v1.12.0.exe
-  - strip --strip-all --remove-section=.comment --remove-section=.note http-v1.12.0.exe
-  - makensis -DHTTP_VERSION=v1.12.0 install.nsi
+  - cp target\release\http.exe http-v1.12.1.exe
+  - strip --strip-all --remove-section=.comment --remove-section=.note http-v1.12.1.exe
+  - makensis -DHTTP_VERSION=v1.12.1 install.nsi
 
 test: off
 test_script:
   - cargo test --verbose --release
 
 artifacts:
-  - path: http-v1.12.0.exe
-  - path: http v1.12.0 installer.exe
+  - path: http-v1.12.1.exe
+  - path: http v1.12.1 installer.exe
 
 deploy:
   provider: GitHub
-  artifact: /http.*v1.12.0.*\.exe/
+  artifact: /http.*v1.12.1.*\.exe/
   auth_token:
     secure: ZTXvCrv9y01s7Hd60w8W7NaouPnPoaw9YJt9WhWQ2Pep8HLvCikt9Exjkz8SGP9P
   on:
diff --git a/src/ops/mod.rs b/src/ops/mod.rs
index f98bed4..e78a3b1 100644
--- a/src/ops/mod.rs
+++ b/src/ops/mod.rs
@@ -809,7 +809,7 @@ impl HttpHandler {
                         if is_file { "file" } else { "dir" },
                         file_icon_suffix(&path, is_file),
                         path.file_name().map(|p| p.to_str().expect("Filename not UTF-8").replace('.', "_")).as_ref().unwrap_or(&fname),
-                        fname,
+                        fname.replace('<', "&lt;"),
                         if is_file { "" } else { "/" },
                         if show_file_management_controls {
                             DisplayThree("<span class=\"manage\"><span class=\"delete_file_icon\">Delete</span>",
@@ -919,7 +919,7 @@ impl HttpHandler {
                         path.file_name().map(|p| p.to_str().expect("Filename not UTF-8").replace('.', "_")).as_ref().unwrap_or(&fname),
                         if is_file { "file" } else { "dir" },
                         file_icon_suffix(&path, is_file),
-                        fname,
+                        fname.replace('<', "&lt;"),
                         if is_file { "" } else { "/" },
                         file_time_modified(&fmeta).strftime("%F %T").unwrap(),
                         if is_file {
diff --git a/src/util/mod.rs b/src/util/mod.rs
index ba10286..d93b9e1 100644
--- a/src/util/mod.rs
+++ b/src/util/mod.rs
@@ -339,7 +339,7 @@ pub fn file_time_modified(m: &Metadata) -> Tm {
 
 /// Get the timestamp of the file's last modification as a `time::Tm` in UTC.
 pub fn file_time_created(m: &Metadata) -> Tm {
-    file_time_impl(m.created().expect("Failed to get file created date"))
+    file_time_impl(m.created().or_else(|_| m.modified()).expect("Failed to get file created date"))
 }
 
 /// Get the timestamp of the file's last access as a `time::Tm` in UTC.


Test patch: