192661 - Dependency graphs print bug summaries without html encoding

Status: RESOLVED FIXED

(Bugzilla :: Reporting/Charting, defect)

Description

[Jouni Heikniemi]

Locally generated dependency graphs print bug summaries without html encoding
when including summaries. I noticed this when patching bug 166346 and the patch
there doesn't include a fix for this. 

To reproduce: Configure BZ to use local dot installation, give a bug a summary
like '"><script>alert('yeah!')</script>' and create a dep graph with summaries.
You should see the alert dialog.

Comment 1

[Dave Miller [:justdave]]

uh oh

FYI, this is in the 2.16 branch as well.  2.16.3 here we come

Comment 2

[Dave Miller [:justdave]]

mine

Comment 3

[Dave Miller [:justdave]]

Attachment: Patch against tip

Comment 4

[Dave Miller [:justdave]]

Attachment: patch against 2.16 branch

Comment 5

[Dave Miller [:justdave]]

You can experience this exploit first-hand at
http://landfill.bugzilla.org/bugzilla-tip/showdependencygraph.cgi?id=1&showsummary=on

Comment 6

[Bradley Baetz (:bbaetz)]

Comment on attachment 114184 [details] [diff] [review]
Patch against tip

Ew, that code is ugly.

r=bbaetz

Comment 7

[Bradley Baetz (:bbaetz)]

Comment on attachment 114185 [details] [diff] [review]
patch against 2.16 branch

And again, eww + r=bbaetz

Comment 8

[Gervase Markham [:gerv]]

Comment on attachment 114185 [details] [diff] [review]
patch against 2.16 branch

r=gerv.

Gerv

Comment 9

[Gervase Markham [:gerv]]

Comment on attachment 114184 [details] [diff] [review]
Patch against tip

r=gerv.

Gerv

Comment 10

[Dave Miller [:justdave]]

Putting this on the approval list...  will hold it there until about a day
before we're ready to roll with the release announcement, then we'll check it
in.  (that way we don't have it showing up on bonsai where people can see it
before it's been announced)

Comment 11

[Dave Miller [:justdave]]

I applied this patch on bmo, because it's now using local dot.

Comment 12

[Dave Miller [:justdave]]

Just as FYI, this was introduced with the checkin from bug 134571, which was
checked in on 2002-05-07.

Comment 13

[Dave Miller [:justdave]]

This is on hold for the moment until we sort out another security hole that was
just found.  We were mere hours from releasing 2.16.3 and 2.17.4 this morning
when it was found and I got a frantic "stop the presses" email.  We'll probably
be a few days sorting it out, but 2.16.3 and 2.17.4 will go out (with this in
it) as soon as we have all the known holes plugged.

Comment 14

[Dave Miller [:justdave]]

HEAD:

Checking in showdependencygraph.cgi;
/cvsroot/mozilla/webtools/bugzilla/showdependencygraph.cgi,v  <-- 
showdependencygraph.cgi
new revision: 1.27; previous revision: 1.26
done

BUGZILLA-2_16-BRANCH:

Checking in showdependencygraph.cgi;
/cvsroot/mozilla/webtools/bugzilla/showdependencygraph.cgi,v  <-- 
showdependencygraph.cgi
new revision: 1.18.2.2; previous revision: 1.18.2.1
done

Comment 15

[Dave Miller [:justdave]]

Security Advisory has been posted, removing security group