367674 - [SECURITY] XSS when reading Atom feeds due to unescaped HTML

Status: RESOLVED FIXED

(Bugzilla :: Query/Bug List, defect)

Description

[Frédéric Buclin]

As described in bug 314659 comment 6 and later, it's possible to attempt some XSS using unfiltered realnames or potentially any other fields passed to the feed. This could let a user inject some HTML code in his realname, wait for a user in some security group to view a bug list containing some security bugs and a bug he reported and collect all the data thanks to the corrupted generated HTML page.

Comment 1

[Max Kanat-Alexander]

This is definitely a blocker. If it's fixed before we release 2.22.2, we'll take it for that. Otherwise I'll change the flag to blocking2.22.3.

Comment 2

[Frédéric Buclin]

I'm on it. Patch coming soon...

Comment 3

[Frédéric Buclin]

Attachment: patch for tip and branches, v1

FILTER none -> FILTER html

Comment 4

[Frédéric Buclin]

Attachment: useless backport. The one above applies on all branches.

Comment 5

[Max Kanat-Alexander]

tip:

Checking in template/en/default/list/list.atom.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/list/list.atom.tmpl,v  <--  list.atom.tmpl
new revision: 1.2; previous revision: 1.1
done

2.22:

Checking in template/en/default/list/list.atom.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/list/list.atom.tmpl,v  <--  list.atom.tmpl
new revision: 1.1.4.1; previous revision: 1.1
done

2.20:

Checking in template/en/default/list/list.atom.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/list/list.atom.tmpl,v  <--  list.atom.tmpl
new revision: 1.1.2.3; previous revision: 1.1.2.2
done

Comment 6

[Max Kanat-Alexander]

Security advisory posted, unlocking bug.