1607097 - HTML tags are interpreted in a topic change message

Status: RESOLVED FIXED

(Chat Core :: IRC, defect)

Description

[dpb]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0

Steps to reproduce:

Enter the command "/topic a <b> c" in an IRC channel where you have ops.

Actual results:

Thunderbird prints the following message:

SpecLad изменил тему на: a c. ("SpecLad changed the topic to: a c.")

The letter "c" is printed in bold.

The same display error happens with the topic message you get when you enter the channel.

Expected results:

The topic should be printed as-is, i.e.:

SpecLad изменил тему на: a <b> c.

Comment 1

[Florian Quèze [:florian]]

The topic seems to be set correctly, it's only the system message displayed in the conversation that's incorrect.

Comment 2

[dpb]

Yes, this is about the message.

Comment 3

[Patrick Cloke [:clokep]]

Attachment: Patch v1

We have two pieces of code:

1. ctcpFormatToText: strips out the CTCP formatting of messages (and returns plain text).
2. ctcpFormatToHTML: converts the CTCP formatting into the appropriate HTML tags.

Both of these should have been FIRST escaping HTML in the input string, but ctcpFormatToText was not doing this.

Comment 4

[(inactive) Nihanth Subramanya [:nhnt11]]

Comment on attachment 9143792 [details] [diff] [review]
Patch v1

Review of attachment 9143792 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM.

Comment 5

[Patrick Cloke [:clokep]]

Attachment: Patch with author

I failed to include author info in my first patch. This is the same patch, including the previous review status.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/afa946f9ac2e
Do not interpret HTML tags in IRC topic messages. r=nhnt11

Comment 7

[Patrick Cloke [:clokep]]

Comment on attachment 9145059 [details] [diff] [review]
Patch with author

[Approval Request Comment]
Regression caused by (bug #): Not a regression.
User impact if declined: If a declined a malicious actor can add HTML to a topic in an IRC conversation and show odd content. It shouldn't cause any security issues since the HTML should be cleaned, but is likely an abuse vector.
Testing completed (on c-c, etc.): This has been out since 77 betas without any issues.
Risk to taking this patch (and alternatives if risky): Topic messages might be broken for IRC.

Comment 8

[Wayne Mery (:wsmwk)]

Comment on attachment 9145059 [details] [diff] [review]
Patch with author

[Triage Comment]
Thanks for the assessment.  Approved for esr

Comment 9

[Rob Lemley [:rjl]]

Thunderbird 68.8.1:
https://hg.mozilla.org/releases/comm-esr68/rev/af9a06ee0625