1229894 - Backport bug upstream 1221518 to bmo/4.2 [SECURITY] XSS in dependency graphs when displaying the bug summary

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect)

Description

[David Lawrence [:dkl]]

+++ This bug was initially created as a clone of Bug #1221518 +++

During the generation of a dependency graph also the code for the html image map is generated if a local dot installation is used.
With html escaped characters in a bug summary it is possible to inject custom lines in the *.map file with which the CreateImagemap function generates html code without filtering.

poc:
- configure bugzilla to use a local dot installation to generate a dependency graph
- create a bug with the following summary: &#10;default "><script>alert(1)</script> G
- visit /showdependencygraph.cgi?id=<BUG-ID>&showsummary=on&display=tree&rankdir=TB, a javascript alert prompt will show up

Comment 1

[David Lawrence [:dkl]]

Attachment: 1229894_1.patch

Straight backport of the 4.2 patch on bug 1221518 fixes the issue

Comment 2

[Dylan Hardison [:dylan] (he/him)]

Comment on attachment 8694885 [details] [diff] [review]
1229894_1.patch

Review of attachment 8694885 [details] [diff] [review]:
-----------------------------------------------------------------

r=dylan

Comment 3

[Kendall Libby [:fubar] (he/him)]

hot patched in bugzillaadm:/data/bugzilla/www/bugzilla.mozilla.org, deployed to web heads, and httpd restarted.

note: any regular BMO push will overwrite that.

Comment 4

[David Lawrence [:dkl]]

To ssh://[e-mail]/webtools/bmo/bugzilla.git
   8a1506c..8f50123  master -> master