From a954f426cb0d9d475d3bfe364bae41c6728eb5bf Mon Sep 17 00:00:00 2001 From: azerom960 Date: Tue, 29 Sep 2026 23:22:04 -0400 Subject: [PATCH 1/2] RDKEMW-25979: Add ENT_QUOTES encoding to HostName in port_forwarding_add.jst Add htmlspecialchars with ENT_QUOTES encoding to the HostName variable before output in the HTML table to prevent XSS attacks via DHCP client hostname in the Connected Devices picker. Adds a focused security regression test that verifies ENT_QUOTES is used. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- source/Styles/xb3/jst/port_forwarding_add.jst | 2 +- tests/port_forwarding_add_jst_xss_test.sh | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 tests/port_forwarding_add_jst_xss_test.sh diff --git a/source/Styles/xb3/jst/port_forwarding_add.jst b/source/Styles/xb3/jst/port_forwarding_add.jst index de23cee..a576bfe 100644 --- a/source/Styles/xb3/jst/port_forwarding_add.jst +++ b/source/Styles/xb3/jst/port_forwarding_add.jst @@ -599,7 +599,7 @@ $('#device').click(function(){ $hostNums = "2"; }*/ for ($i=1; $i <= $hostNums; $i++) { - $HostName = getStr("Device.Hosts.Host."+$hostsInstanceArr[$i]+".HostName"); + $HostName = htmlspecialchars(getStr("Device.Hosts.Host."+$hostsInstanceArr[$i]+".HostName"), ENT_QUOTES, 'UTF-8'); $IPAddress = getStr("Device.Hosts.Host."+$hostsInstanceArr[$i]+".IPAddress"); $Active = getStr("Device.Hosts.Host."+$hostsInstanceArr[$i]+".Active"); $IPv6Addr = "EMPTY"; diff --git a/tests/port_forwarding_add_jst_xss_test.sh b/tests/port_forwarding_add_jst_xss_test.sh new file mode 100644 index 0000000..ca4e43f --- /dev/null +++ b/tests/port_forwarding_add_jst_xss_test.sh @@ -0,0 +1,7 @@ +#!/bin/sh +if sed -n '602p' source/Styles/xb3/jst/port_forwarding_add.jst | grep -q "ENT_QUOTES"; then + echo "PASS: HostName uses ENT_QUOTES" +else + echo "FAIL: HostName does not use ENT_QUOTES" + exit 1 +fi From 1e42caf52565a4fafbeba9384241714315db7eb2 Mon Sep 17 00:00:00 2001 From: azerom960 Date: Wed, 30 Sep 2026 01:18:43 -0400 Subject: [PATCH 2/2] RDKEMW-25979: Trigger fresh CI run to clear stale pr-lint checks Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com]