615789 - Output not sanitized in JSON->HTML display

Status: VERIFIED FIXED

(Webtools Graveyard :: BzAPI, defect)

Description

[Cameron McCormack (:heycam)]

If viewing the HTMLified JSON output from a BzAPI URL, it doesn't escape any markup that might be in a field.

For example I put "<script>alert('hi')</script>" in the Whiteboard of this bug https://landfill.bugzilla.org/bzapi_sandbox/show_bug.cgi?id=9947 and then when viewing https://api-dev.bugzilla.mozilla.org/test/latest/bug/9947 you get the alert.

Comment 1

[Gervase Markham [:gerv]]

This is a bug in Catalyst::Action::REST's YAML::HTML serializer.
https://rt.cpan.org/Public/Bug/Display.html?id=63537

api-dev.bugzilla.mozilla.org does not set cookies AFAIK, and it does not have access to bugzilla.mozilla.org cookies (which are limited to that exact domain) so there is no risk of XSS cookie stealing. However, I know other attacks are possible with XSS, so I am hoping they will fix this quickly.

Gerv

Comment 3

[Yvan Boily [:ygjb][:yvan]]

Gerv: looking at your patch in the bug report for Catalyst, is it necessary for us to wait on them to implement it, or can we patch it on our deployment?

Comment 4

[Gervase Markham [:gerv]]

Sure we can. I've now patched this on the server. (I have very little hope of it getting fixed upstream.)

Gerv