Repository navigation
Getting extra issue XSS with Path Traversal #2
Description
Hi @davewichers,
Hope you are doing well!
I identified an extra issue (XSS) in the OWASP Benchmark (Python) test case under the Path Traversal category.
Test cases:
- /benchmark/pathtraver-00/BenchmarkTest00615
- /benchmark/pathtraver-00/BenchmarkTest00619
Rule: Path Traversal
this is due to missing escape_for_html in below code for filename.
except IOError as e:
RESPONSE += (
f'Problem reading from file \'{fileName}\': '
f'{escape_for_html(e.strerror)}'
)
return RESPONSE
Activity
davewichers commentedon Mar 11, 2026
Thanks for reporting. While it doesn't affect a tool's score, it's good to clean up extraneous unintentional vulns. I'll get this fixed soon.
davewichers commentedon Mar 18, 2026
There are 5 different path traversal test case types and all of them had this problem. I fixed all of them and just pushed out a fix for not just the 2 test cases you pointed out, but all the others too. Please verify the fix is done properly and I'll close this.
AkashSahai commentedon Mar 18, 2026
Thank you, @davewichers, for your support. The issue is now resolved.