619442 - XSS in showbuilds.cgi due to lack of URI encoding in open_showbuilds_url()

Status: VERIFIED FIXED

(Webtools Graveyard :: Tinderbox, defect)

Description

[mike]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Ubuntu/10.10 Chromium/8.0.552.215 Chrome/8.0.552.215 Safari/534.10
Build Identifier: 

Open the page and scroll to the very bottom.   The injected <script> tag is visible,  and the html of the page is malformed. 

Reproducible: Always

Steps to Reproduce:
1.Click on link
2.view page source

Comment 1

[Reed Loden [:reed]]

Attachment: patch - v1

Comment 2

[Reed Loden [:reed]]

Checking in showbuilds.pl;
/cvsroot/mozilla/webtools/tinderbox/showbuilds.pl,v  <--  showbuilds.pl
new revision: 1.46; previous revision: 1.45
done

Filing bug for push now.

Comment 4

[Michael Coates [:mcoates] (acct no longer active)]

Verified fix in prod. (we should be verifying and marking as such before opening bugs.)

Comment 5

[Reed Loden [:reed]]

(In reply to comment #4)
> Verified fix in prod. (we should be verifying and marking as such before
> opening bugs.)

FTR, I did verify it when the fix was originally pushed.

Comment 6

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.