484098 - Website:Javascript gets interpreted when embedded in persona description

Status: VERIFIED FIXED

(Mozilla Labs Graveyard :: Personas Plus, defect, P1)

Description

[krupa raj[:krupa]]

Attachment: Javascript in persona description

Steps to reproduce:

1.Go to https://sm-weave-proxy01.services.mozilla.com/upload
2.Login;agree to the licenses
3.Fill the required fields in create your own persona field
4.In description field,enter a simple Javascript program  to show the current date and time.
5.Click Submit
6.Login as an admin and approve this persona.
7.Check this persona under all->recent category.

expected result:
 user submitted Javascript is not interpreted 

actual result:
Javascript gets interpreted when embedded in persona description

additional info:
Even though we have an approval stage,the administrator might miss such malicious intent.

Comment 1

[Toby Elliott [:telliott]]

knew I missed an htmlspecialchars somewhere...

Comment 2

[Toby Elliott [:telliott]]

thinking about it some more, I think it's better to sanitize the data on the way in, so you'll need to pull that bad persona, or it'll keep showing up.

Comment 3

[krupa raj[:krupa]]

Verified.