Blocks recursive proxy calls

https://huntr.dev/bounties/d383a6b8-b12a-4893-9b8f-8df18ec679c3/
jgraph · Oct 17, 2022 · 6017127 · 6017127 · davidjgraph · Oct 17, 2022
1 parent b725015
commit 6017127
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/src/main/java/com/mxgraph/online/ProxyServlet.java b/src/main/java/com/mxgraph/online/ProxyServlet.java
@@ -78,6 +78,12 @@ else if (Utils.sanitizeUrl(urlParam))
 
 			try(OutputStream out = response.getOutputStream())
 			{
+				if ("draw.io".equals(ua))
+				{
+					log.log(Level.SEVERE, "Infinite loop detected, proxy should not call itself");
+					throw new UnsupportedContentException();
+				}
+
 				request.setCharacterEncoding("UTF-8");
 				response.setCharacterEncoding("UTF-8");