1067996 - Reflected XSS in mxr.mozilla.org

Status: RESOLVED DUPLICATE of bug 949514

(Webtools Graveyard :: MXR, defect)

Description

[Dan McInerney]

Attachment: mozillaXSS.png

User Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.120 Safari/537.36

Steps to reproduce:


1. With Firefox, go to http://mxr.mozilla.org/mozilla-central/source/nsprpub/pr/include/prtime.h/%3Csvg%20onload=prompt%284%29%3E
2. Notice JS pop up. 

Just tack on a '/' + XSS payload to the end of the URL for many of these http://mxr.mozilla.org/mozilla-central/source/browser/devtools/... domains and you'll get XSS'ed.

Some more examples: http://mxr.mozilla.org/mozilla-central/source/browser/devtools/tilt/TiltWorkerPicker.js/%3Csvg%20onload=prompt%284%29%3E

http://mxr.mozilla.org/mozilla-central/source/mobile/android/base/toolbar/%3Csvg%20onload=prompt%284%29%3E



Actual results:

A javascript pop up appeared after entering the payloaded URL.


Expected results:

The input should've been filtered.

Comment 1

[Frederik Braun [:freddy]]

I could reproduce the XSS.

Comment 2

[Frederik Braun [:freddy]]

CCing fubar: Should this be assigned to you?

Comment 3

[Kendall Libby [:fubar] (he/him)]

Didn't we recently (try to) fix a similar XSS issue? :-\

No, code changes don't go to me, I just manage the deploys. I think :dkl got the last code change, but check with :mcote for his availability or alternative.

Comment 4

[Kendall Libby [:fubar] (he/him)]

Aha, Bug 949514. Same thing?

Comment 5

[Frederik Braun [:freddy]]

My bad. I was surprised I didn't find a duplicate. Maybe I should have looked harder.

Thanks fubar!

Comment 6

[Frederik Braun [:freddy]]

Sorry for the confusion, Dan!
You have been copied into the existing bug <https://bugzilla.mozilla.org/show_bug.cgi?id=949514>, which was already discussed and resolved earlier.