978488 - Globalratings server doesn't seem to handle quotes in developer name

Status: RESOLVED FIXED

(Marketplace Graveyard :: General, defect, P3)

Description

[Daniele "Mte90" Scasciafratte]

Attachment: screenshot2.png

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:29.0) Gecko/20100101 Firefox/29.0 Iceweasel/29.0a2 (Beta/Release)
Build ID: 20140214004003

Steps to reproduce:

Go to the marketplace
Add the manifest
I do all the steps to certification
Click on the button for generate the certificate
Error in the globalratings page



Actual results:

The page https://www.globalratings.com/IARCProdRating/Submission.aspx is as the screenshot attached.
I've see that if the developer name in the manifest have ' or " the page on global ratings crash.

In this case the developer name was Daniele 'Mte90' Scasciafratte.


Expected results:

Correct page on globalratings

Comment 1

[Rob Hudson [:robhudson]]

Christine, could you look into this? I thought we solved this already by sending double encoded HTML.

Comment 2

[Christine McCarthy]

Rob, I'm on this. I'll try to give you some information about what's going on here as soon as I have it.

Comment 3

[Christine McCarthy]

We dealt with this issue when we encountered data containing < and > in bug 962362 (https://bugzilla.mozilla.org/show_bug.cgi?id=962362). You guys are now double encoding so that we receive a &lt; and &gt;. The issue here as that the encoding of the ' character is &#39; and the combination "&#" is seen as a potential threat by asp.net's form validation. One possible solution is for it to be passed as &apos; (using the HTML entity, rather than the ASCII encoding). I am looking into ways for us to handle it from our end.

Comment 4

[Daniele "Mte90" Scasciafratte]

Any news about this?

Comment 5

[Christine McCarthy]

We did put in a temporary fix for this. It actually stores the ' character as ' and subsequently occasionally prints it to screen with that encoding, but does not prevent the developer from making their submission. We are still exploring avenues for completely solving this problem.

Comment 6

[Andy McKay]

Based on the last comment, sounds like its fixed from our point of view.