849951 - Orange Factor xss brasstacks.mozilla.com

Status: RESOLVED FIXED

(Tree Management Graveyard :: OrangeFactor, defect)

Description

[Sony]

Attachment: bug-br.JPG

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:19.0) Gecko/20100101 Firefox/19.0
Build ID: 20130307023931

Steps to reproduce:

Hello,

we have xss in url 

test this on mozilla firefox without plugins. 


Actual results:

Open link in browser and wait for xss sometime. 

http://brasstacks.mozilla.com/orangefactor/?display=TopBugs&tree=trunk&includefiltertype=quicksearch&includefilterdetailsquicksearch=;alert%28String.fromCharCode%2888,83,83%29%29//%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;%20alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//--%20%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E&includefilterdetailsexcludeResolved=false&includefilterdetailsexcludeDisabled=false&includefilterdetailsnumbugs=0&includefilterdetailsresolvedIds=&excludefiltertype=quicksearch&excludefilterdetailsquicksearch=&excludefilterdetailsnumbugs=0&excludefilterdetailsresolvedIds=

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

assigning to rforbes for verificaiton

Comment 2

[Mark Côté [:mcote]]

I'm not seeing this reliably on latest released Firefox nor Nightly on OS X; it happened once, but some time after the page loaded, and I'm not sure what I did to trigger it.  However it does happen every time on Safari.

A shorter URL which still triggers the problem is

http://brasstacks.mozilla.com/orangefactor/?includefiltertype=quicksearch&includefilterdetailsquicksearch=;alert%28String.fromCharCode%2888,83,83%29%29//%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;%20alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//--%20%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E

I'm investigating this now.

Comment 3

[Raymond Forbes[:rforbes]]

confirmed, this is working for me.

Comment 4

[Daniel Veditz [:dveditz]]

brasstacks is not on our list of eligible sites, it's an internal testing server.

Comment 5

[Mark Côté [:mcote]]

Attachment: Encode generated URLs

In the end, really dumb and simple.

Comment 6

[Mark Côté [:mcote]]

Pushed and deployed.

http://hg.mozilla.org/automation/orangefactor/rev/f79928cf0f88

Comment 7

[Mark Côté [:mcote]]

Could I get confirmation that this is properly fixed?

Comment 8

[Mark Côté [:mcote]]

Actually this isn't quite right. It should use encodeURIComponent() on individual GET-variable names and values to take care of characters like &.

Comment 9

[Mark Côté [:mcote]]

Attachment: Encode GET args of generated URLs

This encodes every GET arg separately with encodeURIComponent(), which, unlike encodeURI(), encodes '&', without which our args can get messed up.

Comment 10

[Mark Côté [:mcote]]

Pushed and deployed.  Looking for confirmation again. :)

http://hg.mozilla.org/automation/orangefactor/rev/6c416e5c0181

Comment 12

[Ed Morley [:emorley]]

Opening bug since this was fixed 2.5 years ago.