741335 - BetaFarm: Edit project is vulnerable to XSS

Status: VERIFIED FIXED

(Websites :: mozillalabs.com, defect)

Description

[Mark Goodwin [:mgoodwin]]

Issue:
Betafarm is vulnerable to XSS on the edit project feature. I'm unsure of the impact of this as I don't know how 'trusted' project owners are.

Steps to reproduce:
1) log in to betafarm as a project owner
2) Edit the long description to include <script>alert(123)</script>
3) observe the alert pop up on submitting the form / viewing the project as another user

Remediation:
Ensure any output is adequately encoded - see secure coding guidelines at https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Preventing_XSS

If HTML is required, consider:
1) parsing the document (e.g. with BeautifulSoup)
2) Removing all attributes and elements not in a whitelist

Comment 1

[Mark Goodwin [:mgoodwin]]

There may be other issues like this elsewhere in the site; please ensure other user-supplied input is output encoded prior to rendering. Please use this document for guidance https://mana.mozilla.org/wiki/display/INFRASEC/XSS+and+Jinja2.

Also, I've been working on some Jinja2 filters that may help you: https://github.com/mozmark/xssfilter

Comment 2

[[github robot]]

Commits pushed to master at https://github.com/mozilla/betafarm

https://github.com/mozilla/betafarm/commit/10fe349d2add3be747b18ba5dea7ebe00bff000b
removed |safe; fix bug 741335

https://github.com/mozilla/betafarm/commit/05257eedf3ec4d31e7e7b4f1133c1e7d20057fa3
Merge pull request #49 from ednapiranha/bug741335

removed |safe; fix bug 741335

Comment 3

[Rebecca Billings [:rbillings]]

Verified that no script errors pop up and script tags are ignored upon input.

Comment 4

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.