riscv-openocd/src
Andreas Fritiofson 6d54d90541 CVE-2018-5704: Prevent some forms of Cross Protocol Scripting attacks
OpenOCD can be targeted by a Cross Protocol Scripting attack from
a web browser running malicious code, such as the following PoC:

var x = new XMLHttpRequest();
x.open("POST", "http://127.0.0.1:4444", true);
x.send("exec xcalc\r\n");

This mitigation should provide some protection from browser-based
attacks and is based on the corresponding fix in Redis:

8075572207/src/networking.c (L1758)

Change-Id: Ia96ebe19b74b5805dc228bf7364c7971a90a4581
Signed-off-by: Andreas Fritiofson <andreas.fritiofson@gmail.com>
Reported-by: Josef Gajdusek <atx@atx.name>
Reviewed-on: http://openocd.zylin.com/4335
Tested-by: jenkins
Reviewed-by: Jonathan McDowell <noodles-openocd@earth.li>
Reviewed-by: Paul Fertser <fercerpav@gmail.com>
2019-11-22 18:25:34 +00:00
..
flash nrf5: update links to compatibility matrixes for nrf5x variants 2019-10-18 09:24:25 +01:00
helper helper/command: clear errno before calling parser 2019-09-24 05:47:18 +01:00
jtag jtag: usb_blaster: Add missing 'default' to switch statement 2019-11-07 08:21:19 +00:00
pld helper/command: change prototype of command_print/command_print_sameline 2019-05-14 19:37:11 +01:00
rtos gdb_server, rtos: Fine-grained RTOS register access 2019-08-28 08:07:37 +01:00
server CVE-2018-5704: Prevent some forms of Cross Protocol Scripting attacks 2019-11-22 18:25:34 +00:00
svf helper/command: change prototype of command_print/command_print_sameline 2019-05-14 19:37:11 +01:00
target STM8 Target relicensing to GPLv2 and later 2019-11-07 08:21:40 +00:00
transport helper/command: change prototype of command_print/command_print_sameline 2019-05-14 19:37:11 +01:00
xsvf helper/command: change prototype of command_print/command_print_sameline 2019-05-14 19:37:11 +01:00
Makefile.am Convert to non-recursive make 2016-12-08 16:23:10 +00:00
hello.c helper/command: change prototype of command_print/command_print_sameline 2019-05-14 19:37:11 +01:00
hello.h Make #include guard naming consistent 2016-05-24 22:30:55 +01:00
main.c Remove FSF address from GPL notices 2016-05-24 22:30:01 +01:00
openocd.c mflash: Remove this broken flash driver 2019-07-28 21:17:47 +01:00
openocd.h Make #include guard naming consistent 2016-05-24 22:30:55 +01:00