152688 - doctor error message does not escape input

Status: RESOLVED FIXED

(Webtools Graveyard :: Doctor, defect)

Description

[Jesse Ruderman]

http://doctor.mozilla.org/doctor.cgi?action=edit&file=<script>alert(5)</script>

Result: two dialogs and confused text.
Expected: no dialogs and text like "Cannot find file <script>alert(5)</script>".

This is bad because a page could link to a URL similar to the one above and then
read the user's CVS password from password manager.  People being able to steal
bugzilla passwords is bad, but people being able to steal CVS passwords is very
bad.  Please check Doctor for other similar bugs.

Comment 1

[Myk Melez [:myk] [@mykmelez]]

Checking in doctor.cgi;
/cvsroot/mozilla/webtools/doctor/doctor.cgi,v  <--  doctor.cgi
new revision: 1.10; previous revision: 1.9
done
RCS file: /cvsroot/mozilla/webtools/doctor/templates/cvs-error.tmpl,v
done
Checking in templates/cvs-error.tmpl;
/cvsroot/mozilla/webtools/doctor/templates/cvs-error.tmpl,v  <--  cvs-error.tmpl
initial revision: 1.1
done

Comment 2

[Daniel Veditz [:dveditz]]

Has this regressed? Or was it only fixed for the edit action?

http://sla.ckers.org/forum/read.php?3,44,2090,page=21#msg-2092

Comment 3

[Reed Loden [:reed]]

Attachment: Always filter HTML from message - v1

Seems the "FILTER html" part on the message variable got lost two months after it was originally fixed. This patch adds it back.

Comment 4

[Max Kanat-Alexander]

Comment on attachment 243292 [details] [diff] [review]
Always filter HTML from message - v1

This is obviously correct. r=mkanat by inspection (and noticing that the URL in comment 0 does indeed provide an XSS hole).

Comment 5

[Reed Loden [:reed]]

Checking in code-error.tmpl;
/cvsroot/mozilla/webtools/doctor/templates/code-error.tmpl,v  <--  code-error.tmpl
new revision: 1.4; previous revision: 1.3
done
Checking in user-error.tmpl;
/cvsroot/mozilla/webtools/doctor/templates/user-error.tmpl,v  <--  user-error.tmpl
new revision: 1.4; previous revision: 1.3
done

I will request that the production Doctor instance be upgraded to latest CVS.

Comment 6

[Dave Miller [:justdave]]

(In reply to comment #5)
> I will request that the production Doctor instance be upgraded to latest CVS.

Done.