1140798 - Possible client side code injection in "suggested reviewers" menu.

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: Extensions, defect)

Description

[Tooru Fujisawa [:arai]]

/extensions/Review/web/js/review.js line 150
>        items.push({
>            name: user.identity + ' (' + queue + ')',

here, `name` property is parsed as HTML, but it's not escaped.
Currently mail address is braced with <>, and it's treated as HTML tag, so it's not shown there literally, and queue count is inside that element.

Reviewers and mentors might be able to inject any HTML via their name (login field), not yet confirmed though.

Comment 1

[Tooru Fujisawa [:arai]]

It's already fixed in upstream jQuery-contextMenu on 13 Sep 2014, but seems not yet released, latest 1.6.6 was released on 12 Jul 2014 :/
https://github.com/medialize/jQuery-contextMenu/commit/f3137f21e17d3f91dad6f913eb3a0e93ada35b8a

Comment 2

[Tooru Fujisawa [:arai]]

Attachment: backport changeset f3137f21e17d3f91dad6f913eb3a0e93ada35b8a of jQuery-contextMenu

This could be the simplest solution, but not sure it's the best solution...
There are many changesets from last release, so, if trunk is stable enough, just using trunk might be better.

Comment 3

[David Lawrence [:dkl]]

Comment on attachment 8574359 [details] [diff] [review]
backport changeset f3137f21e17d3f91dad6f913eb3a0e93ada35b8a of jQuery-contextMenu

Review of attachment 8574359 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl. Thanks for the patch!

Comment 4

[Tooru Fujisawa [:arai]]

Thank you for reviewing!

Comment 5

[David Lawrence [:dkl]]

To ssh://[e-mail]/webtools/bmo/bugzilla.git
   0d3b1ca..b199f49  master -> master

Comment 6

[Tooru Fujisawa [:arai]]

Thanks again :D