828909 - Sanitize Wi-Fi hotspot username and password

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Wifi, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

See bug 825049 comment 7, which is right on the money. Vincent, is it possible to escape the quotes here or should we disallow passwords with quotes in them?

Vincent, we talked about using "".replace, but I don't think that's the right way to go. You need to be careful about previously-escaped slashes and escaped slashes.

Comment 1

[Lucas Adamski [:ladamski]]

Yeah, there's probably lots of encoding issues we should worry about beyond a simple rouge ".  Adding PaulJT for more info.

Blocking here as we need to address in some minimal way at least.

Comment 2

[Vincent Chang[:vchang][changyihsin]]

Attachment: Patch v1.0

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 700445 [details] [diff] [review]
Patch v1.0

Review of attachment 700445 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/system/gonk/net_worker.js
@@ +380,5 @@
>  }
>  
> +function escapeQuote(str) {
> +  str = str.replace(/\\/g, "\\\\");
> +  return str.replace(/\"/g, "\\\"");

You don't need the \ in front of the quote in the regexp.

Comment 4

[Vincent Chang[:vchang][changyihsin]]

Attachment: Patch v1.1

Comment 5

[Johnny Stenback (:jst)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2d1152cf727e

Comment 6

[Vincent Chang[:vchang][changyihsin]]

(In reply to Johnny Stenback (:jst, [e-mail]) from comment #5)
> https://hg.mozilla.org/integration/mozilla-inbound/rev/2d1152cf727e

Thank you, Johnny.

Comment 7

[Johnny Stenback (:jst)]

https://hg.mozilla.org/releases/mozilla-b2g18/rev/22aff697228d

Comment 8

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/2d1152cf727e

Comment 9

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/2d1152cf727e

Comment 10

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/2d1152cf727e