1239540 - Self-XSS in support.mozilla.org search

Status: RESOLVED DUPLICATE of bug 1238252

(support.mozilla.org :: Search, defect)

Description

[Delwar Alam]

Attachment: Screenshot from 2016-01-14 07:29:47.png

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:43.0) Gecko/20100101 Firefox/43.0
Build ID: 20151210163017

Steps to reproduce:

I am delwar alam
i found xss vulnerability in your domain
(https://support.mozilla.org)


Actual results:

when i input some script show all script in your domain


Expected results:

but show popup and show your domain name user cookie and other

Comment 1

[Delwar Alam]

input this script in search box 
"><img src=x onerror=prompt(document.domain)>

Comment 3

[Tom Tromey :tromey]

Attachment: avoid ASan leak report by holding PseudoStack in ImageBridgeChild

This patch seems to avoid the report, at least for the simple
preliminary test I did:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=19cee316ee5a

I didn't do a full test.  For this I assume I need the patch from the
original try push - but do I need to do anything else specially as well?

Comment 4

[Tom Tromey :tromey]

Comment on attachment 8717530 [details] [diff] [review]
avoid ASan leak report by holding PseudoStack in ImageBridgeChild

Typo in the bug number.