154030 - HTML directory indexer doesn't html-escape url

Status: VERIFIED FIXED

(Core :: Security, defect, P1)

Description

[Bradley Baetz (:bbaetz)]

As reported by [e-mail] to the security group, the uri (which is
added to the page) isn't html escaped:

<quote>
+ Exploit code:
~~~~~~~~~~~~~~~~~
<a href="ftp://'FTPserver' or
'FTP+HTTPserver'/#%3C%2ftitle%3E%3Cscript%3Ealert(%22exploit%22);%3C%2fscript%3E">Exploit</a>
</quote>

(You need to add a valid ftp server in there)

Patch coming

Comment 1

[Bradley Baetz (:bbaetz)]

Attachment: patch

This rearranges code a bit so that we don't leak while using the raw pointers
the escaping functions require (Also fixes an existing leak of |spec|, too)

Comment 2

[Doug Turner (:dougt)]

Comment on attachment 89011 [details] [diff] [review]
patch

r-dougt

Comment 3

[Bradley Baetz (:bbaetz)]

*** Bug 154029 has been marked as a duplicate of this bug. ***

Comment 4

[Darin Fisher]

Comment on attachment 89011 [details] [diff] [review]
patch

>Index: nsIndexedToHTML.cpp

>+    char* spec = nsCRT::strdup(titleUri.get());
>+    nsXPIDLString unEscapeSpec;
>+    rv = mTextToSubURI->UnEscapeAndConvert(encoding, spec,
>+                                           getter_Copies(unEscapeSpec));
>+    nsCRT::free(spec);

why strdup?  second param to UnEscapeAndConvert is |const char *|, so
what's wrong with |titleUri.get()|?

justify/fix and sr=darin

Comment 5

[Bradley Baetz (:bbaetz)]

darin: Historical reasons - that used to call nsUnescape.

Checked in with that change to the trunk; I'll mail drivers for the branch.

Comment 6

[Judson Valeski]

Comment on attachment 89011 [details] [diff] [review]
patch

adding darin's sr.

Comment 7

[Judson Valeski]

please checkin to the 1.0.1 branch. once there, remove the "mozilla1.0.1+"
keyword and add the "fixed1.0.1" keyword.

Comment 8

[Bradley Baetz (:bbaetz)]

Fixed on branch, too (after my checkin last night was backed out because the
tree was closed. Oops)

Comment 9

[bsharma]

Verified on 2002-06-27-trunk and 2002-06-27-branch build on Win2K.

Above URL displays the direcrtory contents.