1254675 - bug_modal template fails to escape format parameter

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect)

Description

[Wladimir Palant]

The template extensions/BugModal/template/en/default/bug_modal/edit.html.tmpl contains the following line:

> [%~ '&format=' _ cgi.param("format") IF cgi.param("format") %]"

Note the query parameter "format" being inserted unescaped. The assumption seems to be that this parameter is safe. That's not really the case however, consider the following URL:

> https://bugzilla.mozilla.org/show_bug.cgi?id=490047&format=%22%3E%3Cmo%20dal=%22//1.2.3.4%22%3E

If you look at the this-bug element in the source code, the format parameter not only escaped the attribute, it inserted a tag <mo dal="//1.2.3.4"> into the page. The only reason why this doesn't seem to be exploitable - you cannot add any more letters and building a malicious payload having only the letters "modal" at your disposal is hard.

Comment 1

[David Lawrence [:dkl]]

Attachment: 1254675_1.patch

Comment 2

[Dylan Hardison [:dylan] (he/him)]

Comment on attachment 8728091 [details] [diff] [review]
1254675_1.patch

Review of attachment 8728091 [details] [diff] [review]:
-----------------------------------------------------------------

r=dylan

Comment 3

[David Lawrence [:dkl]]

To ssh://[e-mail]/webtools/bmo/bugzilla.git
   0b7cd97..ad2b169  master -> master

Comment 4

[David Lawrence [:dkl]]

Pushed