45784 - Bugzilla truncates URLs containing double quotes

Status: VERIFIED FIXED

(Bugzilla :: Bugzilla-General, defect, P3)

Description

[Simon Fraser [no longer active]]

Bugzilla truncates URLs containing double quotes. In the ULR field, I typed:

javascript:prompt("Hello");

Comment 1

[Jesse Ruderman]

jst just hit this in bug 62517.

Comment 2

[Jesse Ruderman]

I can set a url containing the double-quote character when I create the bug or 
later, and e-mails show that the field is updated correctly.  When I visit the 
bug, however, I don't see the " or anything after it, and when I submit 
additional changes to the bug, the value actually gets truncated.

What's happening is that show_bug.cgi isn't escaping quotes in the url when it 
puts the url as the value for the "url" textbox.  It also doesn't escape quotes 
for the href of the "url" link next to the textbox.

This is a security hole that allows me to make you run a script that seems to 
come from bugzilla.mozilla.org (I've set up a demonstration at an old "test 
bug", bug bug 31322).  It's not that much easier to exploit than bug 38862, 
which requires me to get you to click on an attachment and which doesn't seem 
likely to be fixed soon, but I still think this bug should be fixed for 2.12.

Comment 3

[Jacob Steenhagen]

Attachment: [PATCH] Use value_quote() for the texbox in the URL Field

Comment 4

[Jacob Steenhagen]

The attached patch adds value_quote() to the part of the code that puts the URL 
in the text box.  It also performs a $URL =~ s/"/\%22/g; to the URL that gets 
linked for the label.

Comment 5

[Jacob Steenhagen]

Attachment: [PATCH] Ver 2... use value_quote() on both values

Comment 6

[Jacob Steenhagen]

In talking on IRC it became apparent that value_quote() would also work for the 
$URL.  This updated patch includes that.

Comment 7

[Ben Bucksch (:BenB)]

-> jake

Comment 8

[Dave Miller [:justdave]]

r= [e-mail]

Comment 9

[Dave Miller [:justdave]]

checked in.

Comment 10

[Tara Hernandez]

Sorry for the spam, but I needed to be able to query for all of these correctly.

Comment 11

[Gervase Markham [:gerv]]

VERIFIED.

Gerv

Comment 12

[Dave Miller [:justdave]]

Moving closed bugs to Bugzilla product