452715 - XSS at developer.mozilla.org Special:Tags

Status: RESOLVED FIXED

(developer.mozilla.org Graveyard :: User management, task)

Description

[Daniel Veditz [:dveditz]]

Report on XSSed.com from "pRaLe" http://www.xssed.com/mirror/49004/

Xss problem on the Special:Tags search page
  http://developer.mozilla.org/Special:Tags?tag=%22/%3E%3Cscript%3Ealert(String.fromCharCode(88,%2083,%2083))%3C/script%3E

or http://developer.mozilla.org/Special:Tags?tag="/><script>alert(String.fromCharCode(88,%2083,%2083))</script>

We need to check other pages, too. If this is a problem in Deki Wiki generically we should inform the upstream

Comment 1

[Eric Shepherd [:sheppy]]

I've forwarded this issue to MindTouch.

Comment 2

[Daniel Veditz [:dveditz]]

It's been a couple of week -- can we please shut this hole on our own site without waiting for MindTouch to fix it? That's what open source is about, right?

Comment 3

[Eric Shepherd [:sheppy]]

I believe this is fixed in the update we'll be installing on Thursday night.

Comment 4

[Eric Shepherd [:sheppy]]

But I'll check to be sure.

Comment 5

[Michael Morgan [:morgamic]]

Eric - if they have not fixed it let us know and we'll do it.

Comment 6

[Eric Shepherd [:sheppy]]

Yes, will do.

Comment 7

[Eric Shepherd [:sheppy]]

This will be in the stable branch tomorrow, so we can pick it up when we do the update to 8.08.

Comment 8

[Eric Shepherd [:sheppy]]

Fixed.

Comment 9

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.