234419 - quoteUrls quotes word "bug" in title="" attribute inserted by itself

Status: RESOLVED DUPLICATE of bug 232861

(Bugzilla :: Attachments & Requests, defect)

Description

[Gervase Markham [:gerv]]

If you put the text "bug 123" in the title of an attachment, quoteUrls
autolinkifies the attachment text with a title= containing the attachment title,
but then also autolinkifies the "bug" word inside that title=.

This manifests itself as broken HTML in the comments. It is best demonstrated
with an example. See next comment.

This issue is not, as far as I can tell, exploitable for cross-site scripting.

Gerv

Comment 1

[Gervase Markham [:gerv]]

Attachment: Problem bug 12345 Problem

The above attachment link should fail to autolinkify correctly.

Gerv

Comment 2

[Gervase Markham [:gerv]]

Indeed it does.

There is a comment in the quoteUrls source (globals.pl:878) which says:

    # In particular, attachment matches go before bug titles, so that titles
    # with 'attachment 1 [details] [diff] [review]' don't double match.

This seems to be the converse of that problem.

Gerv

Comment 3

[Dave Miller [:justdave]]

*** This bug has been marked as a duplicate of 232861 ***