1228069 - XSS in OrangeFactor date parameters

Status: RESOLVED FIXED

(Tree Management Graveyard :: OrangeFactor, defect)

Description

[Ed Morley [:emorley]]

Via email from Michael Gottburg to security@

XSS in:

http://brasstacks.mozilla.com/orangefactor/index.html?display=Bug&tree=all&includefiltertype=quicksearch&includefilterdetailsquicksearch=2400&includefilterdetailsexcludeResolved=false&includefilterdetailsnumbugs=0&includefilterdetailsresolvedIds=&excludefiltertype=quicksearch&excludefilterdetailsquicksearch=&excludefilterdetailsnumbugs=0&excludefilterdetailsresolvedIds=&endday=%3Cscript%3Ealert(%270%27)%3C/script%3E&startday=2011-09-05&bugid=686143

Comment 1

[Ed Morley [:emorley]]

Attachment: Validate startday and endday params

I've vetted all the instances where we use the args directly, and they seem fine (eg the bugid is cast to int, and other params are encodeURIComponent()ed before being used).

Much of the code here is painful to look at (a lot has changed in frontend design patterns since 2010), I'm very much looking forwards to when we replace OrangeFactor... :-)

Comment 2

[Mark Côté [:mcote]]

Comment on attachment 8692609 [details] [diff] [review]
Validate startday and endday params

Review of attachment 8692609 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good; sorry for the delay.

Comment 3

[Ed Morley [:emorley]]

remote:   https://hg.mozilla.org/automation/orangefactor/rev/53d63e91c028

[[e-mail]3 ~]$ cd ~/apps/orangefactor/src/orangefactor/ && hg pull -uv
pulling from http://hg.mozilla.org/automation/orangefactor/
searching for changes
all local heads known remotely
adding changesets
adding manifests
adding file changes
added 1 changesets with 1 changes to 1 files
resolving manifests
getting html/scripts/woo.utils.js
1 files updated, 0 files merged, 0 files removed, 0 files unresolved

[[e-mail]3 ~]# cd /home/webtools/apps/orangefactor/src/orangefactor/ && ./deploy.sh
[[e-mail]3 orangefactor]# /etc/init.d/orangefactor stop; /etc/init.d/orangefactor start; /etc /init.d/nginx reload
stopping orangefactor                                      [  OK  ]
starting orangefactorspawn-fcgi: child spawned successfully: PID: 29052
                                                           [  OK  ]
Reloading nginx:                                           [  OK  ]


Deploy confirmed:

[~/src]$ curl -s 'https://brasstacks.mozilla.com/orangefactor/scripts/woo.utils.js' | grep 'Prevents XSS'
  // Prevents XSS, since the dates are inserted into the markup in all sorts of awful ways.

And the link in comment 0 no longer reproduces.

Thank you for reporting! :-)

Comment 5

[Michael Gottburg]

Yes sorry guys i have reported it twice ...