842063 - HTML injection possible using the bug alias

Status: RESOLVED FIXED

(Bugzilla :: Creating/Changing Bugs, defect)

Description

[Frédéric Buclin]

Due to bug 816266, the bug alias is now part of the <title> of bug reports. But the alias is not filtered and so it's now possible to inject HTML code into the page. See https://landfill.bugzilla.org/bugzilla-tip/show_bug.cgi?id=1 for an example.

Fortunately, the harm you can do is pretty limited (aliases cannot be longer than 20 characters), but it's enough to mess the display of bugs.

This only affects trunk. Keeping the bug restricted till this bug is fixed.

Comment 1

[Frédéric Buclin]

Attachment: patch, v1

Comment 2

[Reed Loden [:reed]]

(In reply to Frédéric Buclin from comment #0)
> Fortunately, the harm you can do is pretty limited (aliases cannot be longer
> than 20 characters), but it's enough to mess the display of bugs.

<script src=//j.mp> is enough to do damage. :/

Comment 3

[Frédéric Buclin]

(In reply to Reed Loden [:reed] from comment #2)
> <script src=//j.mp> is enough to do damage. :/

No, whitespaces are not allowed in aliases. I doubt that you can write anything evil with 20 characters only and without any whitespace. And to exploit the vulnerability, you first have to write </title> to close the title, which leaves you 12 characters only.

Comment 4

[David Lawrence [:dkl]]

Comment on attachment 714818 [details] [diff] [review]
patch, v1

r=dkl

Comment 5

[Frédéric Buclin]

There has been no release with this security hole, so committing the patch now.

Committing to: bzr+ssh://[e-mail]/bugzilla/trunk/
modified template/en/default/bug/show-header.html.tmpl
Committed revision 8584.

Comment 6

[Frédéric Buclin]

curtisk: this bug really doesn't worth a bounty. It's not critical.