Modify

Opened 3 months ago

Closed 3 months ago

Last modified 6 days ago

#11759 closed defect (fixed)

Does not escape HTML for user name.

Reported by: uchida_t@… Owned by: uchida_t@…
Priority: normal Component: AutocompleteUsersPlugin
Severity: normal Keywords:
Cc: hasienda Trac Release:

Description

  1. Enter the user name ([Preferences] - [General] - [Full name]) to <script>alert(1)</script>.
  2. If autocompleted, alert.

This can use to XSS attack.

Attachments (1)

autocompleteusersplugin.patch (1.2 KB) - added by uchida_t@… 3 months ago.

Download all attachments as: .zip

Change History (10)

Changed 3 months ago by uchida_t@…

comment:1 Changed 3 months ago by t2y

It works for our trac-1.0.2dev.

comment:2 Changed 3 months ago by rjollos

  • Status changed from new to accepted

comment:3 Changed 3 months ago by rjollos

As far as I can tell we don't need the change to autocompleteusers/htdocs/js/autocomplete.js in autocompleteusersplugin.patch. The change to autocompleteusers/htdocs/js/format_item.js fixes the issue reported in comment:description. Please let me know if any issues can be reproduced after the forthcoming change.

comment:4 Changed 3 months ago by rjollos

  • Summary changed from Do not escape HTML for user name. to Does not escape HTML for user name.

comment:5 Changed 3 months ago by rjollos

In 13962:

0.4.2dev: Escape HTML when formatting entries for autocompletion.

Patch by uchida_t@…. Refs #11759.

comment:6 Changed 3 months ago by rjollos

  • Resolution set to fixed
  • Status changed from accepted to closed

comment:7 Changed 3 months ago by rjollos

  • Cc hasienda added
  • Owner changed from rjollos to uchida_t@…

comment:8 Changed 2 months ago by uchida_t@…

Thank you!
I confirmed that this has been fixed.

comment:9 Changed 6 days ago by t2y

In 14108:

Refs #11946: Backported escape functions for Trac-0.11 compatibility

  • Refs #11759: Reported by uchida_t-san

Add Comment

Modify Ticket

Action
as closed .
The resolution will be deleted. Next status will be 'reopened'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.