506855 - Data is not escaped before being printed in validator

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Admin/Editor Tools, defect)

Description

[Wil Clouser [:clouserw]]

Attachment: screenshot

This is a blocker/security bug.  You can reproduce at https://preview.addons.mozilla.org/en-US/developers/versions/validate/38996 but I'm attaching a screenshot anyway.  There are two issues.  The first is that the pattern it's matching is empty (perhaps it's not escaped either?) and the second is that it's printing out the code from the file but not escaping it.  In this case, an iframe.  The source of that area of the page is:

<li class="warning">
                                            <a href="https://preview.addons.mozilla.org/files/browse/22340/0/?start=chrome/content/aefirstpopup.xul">
                        chrome/content/aefirstpopup.xul (72)</a> :
                                                                Matched Pattern: "//i"                                       
                                            <div class="code">

                                                            <div class="line">  <separator class="thin"></separator>&nbsp;</div>
                                                            <div class="line target">  <iframe id="logbox" src="chrome://attachmentextractor/content/changelogloading.xul" height="300px" width="600px"></iframe>&nbsp;</div>
                                                            <div class="line">&nbsp;</div>
                                                    </div>
                                    </li>

Comment 1

[Wil Clouser [:clouserw]]

We should have a unit test for this and double check the output of all the other functions too.  This is a 5.0.8 blocker.

Comment 2

[RJ Walsh [:rjwalsh]]

Attachment: Patch with fixes and tests

Comment 3

[Wil Clouser [:clouserw]]

Comment on attachment 391183 [details] [diff] [review]
Patch with fixes and tests

This fixes the bug for me, thanks.

Comment 4

[RJ Walsh [:rjwalsh]]

Committed r30602

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED on https://preview.addons.mozilla.org/en-US/developers/versions/validate/38996 (by comparing to the screenshot).