638563 - donate.mozilla.org reflected XSS load_locale.ajax.php region_id

Status: VERIFIED FIXED

(Websites :: donate.mozilla.org, defect)

Description

[David Chan [:dchan]]

Data passed to the region_id parameter in load_locale.ajax.php is not properly sanitized before being displayed to the user. This can be leverage to conduct cross-site scripting attacks by luring a user to a specially crafted URL

The page appears to strip out HTML tags. This particular vector uses the onfocus handler with the new HTML autofocus attribute.

STR.
1. Visit above link in Firefox 4
2. You should get an alert box with 1

Recommended remediation:
Entity encode user supplied data before displaying

Comment 1

[Seth Reznik]

We have rolled a patch to address this. 

We fixed the injection, make sure the whole file escapes input properly and returns data with a JSON content-type.

Comment 2

[Chelsea Novak [:chelsea]]

David, can you confirm this is resolved from the patch. We're trying to get all these bugs resolved for launch.
Thanks!

Comment 3

[Michael Coates [:mcoates] (acct no longer active)]

Verified this in stage. All is good here.

Comment 4

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.