416426 - XSS with the general.useragent.extra.firefox

Status: VERIFIED INVALID

(Firefox :: General, defect)

Description

[Phanter Root]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.12) Gecko/20080201 Phanter-RooT
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.8.1.12) Gecko/20080201 Phanter-RooT

If I change the general.useragent.extra.firefox like:

<h1>Phanter-Root

and I create a PHP code like:

<?
echo $HTTP_USER_AGENT;
?>

I execute a HTML code (<h1>Phanter-Root) in the page.





Reproducible: Always

Steps to Reproduce:
1. Go to about:config
2. Add a new chain with name: general.useragent.extra.firefox and value: CODE, example: <h1>Phanter-Root.

Actual Results:  

When you enter in a web page with a code like:

echo $HTTP_USER_AGENT; 

We can execute a code (Like HTML, PHP, JAVASCRIPT, and others...)

Comment 1

[Jesse Ruderman]

It's your PHP code that is buggy, not Firefox.  You need to HTML-escape output that you intend to be shown as text.

Comment 2

[Phanter Root]

Uhmm Ok, Sorry :)

But, put a filter like don't allow >, <, ......

Comment 3

[Jesse Ruderman]

Why?  It's not HTML.