From 86e413dc2aff663245a2d932efc5f3a9fe663c3b Mon Sep 17 00:00:00 2001 From: Anthony Bryant Date: Sun, 8 May 2022 15:27:17 +0100 Subject: [PATCH] Escape single quotes in htmlEntities() (#1413) This should allow SSIDs that contain single quotes to populate data-ssid correctly. Without this patch, clicking on an SSID containing a single quote will either: * Not use the whole SSID, in cases where there's text before the quote: `foo'bar` will appear in the SSID box as just `foo` * Fall back to innerText, in cases where the quote is the first character in the SSID: `'); DROP TABLE WIFI; --` will appear in the SSID box as a version that has spaces converted to non-breaking spaces, causing the connection to eventually fail with WL_NO_SSID_AVAIL. --- WiFiManager.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/WiFiManager.cpp b/WiFiManager.cpp index a1d41dd..dc10035 100644 --- a/WiFiManager.cpp +++ b/WiFiManager.cpp @@ -3363,6 +3363,7 @@ String WiFiManager::htmlEntities(String str, bool whitespace) { str.replace("&","&"); str.replace("<","<"); str.replace(">",">"); + str.replace("'","'"); if(whitespace) str.replace(" "," "); // str.replace("-","–"); // str.replace("\"",""");