771640 - XSS vuln on new article in Kuma editor

Status: VERIFIED FIXED

(developer.mozilla.org Graveyard :: Wiki pages, defect, P1)

Description

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Problematic markup

STR:

1. Load https://developer-new.mozilla.org/en-US/docs/new?slug=jkls
2. In the Title field, enter "</script><script>alert("Hi!");</script>" without the quotes
3. Do the same for the Slug and Tags fields
4. Click Preview Changes

Actual Results:

I get an alert() that says "Hi!", indicating the JS was executed

Expected Results:

No XSS :-(

Comment 1

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Screenshot showing XSS

Comment 2

[John Karahalis [:openjck]]

Does this resolve bug 665735? To think some believe users need jsFiddle to experiment with JavaScript...

Comment 3

[Les Orchard [:lorchard]]

(In reply to John Karahalis [:openjck] from comment #2)
> Does this resolve bug 665735? To think some believe users need jsFiddle to
> experiment with JavaScript...

I don't think this has anything to do with bug 665735

Comment 4

[John Karahalis [:openjck]]

(In reply to Les Orchard [:lorchard] from comment #3)
> (In reply to John Karahalis [:openjck] from comment #2)
> > Does this resolve bug 665735? To think some believe users need jsFiddle to
> > experiment with JavaScript...
> 
> I don't think this has anything to do with bug 665735

Just a joke. :-)

Comment 5

[Les Orchard [:lorchard]]

https://github.com/mozilla/kuma/pull/415

Comment 6

[Luke Crouch [:groovecoder]]

https://developer-new.mozilla.org/en-US/docs/new

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED; thanks!

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Post-fix screenshot

Comment 9

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.

Comment 10

[Will Kahn-Greene [:willkg] ET needinfo? me]

For bugs that are resolved, we remove the security flag. These haven't had their flag removed, so I'm removing it now.