From da568cf56f7badf8aecd1b42056d048a918fb07c Mon Sep 17 00:00:00 2001
From: trinity-1686a <trinity@deuxfleurs.fr>
Date: Wed, 10 Jun 2026 19:32:58 +0200
Subject: [PATCH] fix reflected xss when returning errors on web endpoint

Reported by Filippo Decortes from ares-cyber.ai
---
 Cargo.lock            | 16 ++++++++++++++++
 Cargo.toml            |  1 +
 src/web/Cargo.toml    |  1 +
 src/web/web_server.rs |  2 +-
 4 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2bb5eaf1..7dec9f43 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1881,6 +1881,7 @@ dependencies = [
  "garage_model",
  "garage_table",
  "garage_util",
+ "html-escape",
  "http 1.4.0",
  "http-body-util",
  "hyper 1.9.0",
@@ -2194,6 +2195,15 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "html-escape"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d1ad449764d627e22bfd7cd5e8868264fc9236e07c752972b4080cd351cb476"
+dependencies = [
+ "utf8-width",
+]
+
 [[package]]
 name = "http"
 version = "0.2.12"
@@ -5328,6 +5338,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "utf8-width"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1292c0d970b54115d14f2492fe0170adf21d68a1de108eebc51c1df4f346a091"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
diff --git a/Cargo.toml b/Cargo.toml
index 3ff6d5a0..46477179 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -57,6 +57,7 @@ gethostname = "1.1"
 git-version = "0.3"
 hex = "0.4"
 hexdump = "0.1"
+html-escape = "0.2.13"
 hmac = "0.12"
 itertools = "0.14"
 ipnet = "2.11"
diff --git a/src/web/Cargo.toml b/src/web/Cargo.toml
index a41ab6ef..17966b87 100644
--- a/src/web/Cargo.toml
+++ b/src/web/Cargo.toml
@@ -20,6 +20,7 @@ garage_model.workspace = true
 garage_util.workspace = true
 garage_table.workspace = true
 
+html-escape.workspace = true
 thiserror.workspace = true
 tracing.workspace = true
 percent-encoding.workspace = true
diff --git a/src/web/web_server.rs b/src/web/web_server.rs
index eaff9dc7..203cb767 100644
--- a/src/web/web_server.rs
+++ b/src/web/web_server.rs
@@ -483,7 +483,7 @@ fn error_to_res(e: Error) -> Response<BoxBody<Error>> {
 <li>Message: {s3_message}.</li>
 </ul>",
 			s3_code = err.aws_code(),
-			s3_message = err,
+			s3_message = html_escape::encode_text(&err.to_string()),
 		));
 	}
 	let mut http_error = Response::new(string_body(body_str));