1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
From 4aaacbb1e628a80803ba1a55703db38fccdf7dbf Mon Sep 17 00:00:00 2001
From: Christian Hammond <chipx86@chipx86.com>
Date: Fri, 21 Jun 2013 23:33:16 -0700
Subject: [PATCH] Fix an XSS vulnerability in the reviews dropdown.
The reviews dropdown had a bad vulnerability where it would assume the
user's full name is valid HTML. This allowed the user to craft a script
tag that would be executed every time the name appeared in the dropdown.
This vulnerability exists in 1.6.x, 1.7.x, and the in-development 1.8.
There are no known attacks in the wild.
This was reported by Craig Young at Tripwire.
#---
# reviewboard/htdocs/media/rb/js/reviews.js | 6 ++++--
# 1 file changed, 4 insertions(+), 2 deletions(-)
#diff --git a/reviewboard/htdocs/media/rb/js/reviews.js b/reviewboard/htdocs/media/rb/js/reviews.js
#index 6340744..035872f 100644
#--- a/reviewboard/htdocs/media/rb/js/reviews.js
#+++ b/reviewboard/htdocs/media/rb/js/reviews.js
#@@ -352,10 +352,12 @@ $.fn.reviewsAutoComplete = function(options) {
# $(this)
# .autocomplete({
# formatItem: function(data) {
#- var s = data[options.nameKey];
#+ var s = data[options.nameKey],
#+ desc;
#
# if (options.descKey) {
#- s += " <span>(" + data[options.descKey] + ")</span>";
#+ desc = $('<div/>').text(data[options.descKey]).html();
#+ s += " <span>(" + desc + ")</span>";
# }
#
# return s;
#--
#1.8.1.6
diff -ur ReviewBoard-1.7.7.1.orig/reviewboard/htdocs/static/rb/js/reviews.js ReviewBoard-1.7.7.1/reviewboard/htdocs/static/rb/js/reviews.js
--- reviewboard/htdocs/static/rb/js/reviews.js 2013-04-22 04:40:30.000000000 +0800
+++ reviewboard/htdocs/static/rb/js/reviews.js 2013-06-28 10:38:29.514298074 +0800
@@ -257,10 +257,12 @@
$(this)
.rbautocomplete({
formatItem: function(data) {
- var s = data[options.nameKey];
+ var s = data[options.nameKey],
+ desc;
if (options.descKey && data[options.descKey]) {
- s += " <span>(" + data[options.descKey] + ")</span>";
+ desc = $('<div/>').text(data[options.descKey]).html();
+ s += " <span>(" + desc + ")</span>";
}
return s;
diff -ur ReviewBoard-1.7.7.1.orig/reviewboard/static/rb/js/reviews.js ReviewBoard-1.7.7.1/reviewboard/static/rb/js/reviews.js
--- reviewboard/static/rb/js/reviews.js 2013-04-22 04:40:29.000000000 +0800
+++ reviewboard/static/rb/js/reviews.js 2013-06-28 10:40:09.922290974 +0800
@@ -257,10 +257,12 @@
$(this)
.rbautocomplete({
formatItem: function(data) {
- var s = data[options.nameKey];
+ var s = data[options.nameKey],
+ desc;
if (options.descKey && data[options.descKey]) {
- s += " <span>(" + data[options.descKey] + ")</span>";
+ desc = $('<div/>').text(data[options.descKey]).html();
+ s += " <span>(" + desc + ")</span>";
}
return s;
|
GitWeb
