Bug #16973
Updated by Jim Pingle about 12 hours ago
The FRR status page, @status_frr.php@, does not handle the encoding of FRR status output properly when it is passed through AJAX/JavaScript. It unnecessarily encodes and then decodes the content and then places plain text in containers using methods meant for HTML. Much of the encoding could be removed and replaced with text methods instead. Cases where this might be a concern are very rare, such as a malicious BGP Peer sending a hostname containing an XSS payload. Reported by: @lujiefsi