| • csteipp | |
| Dec 8 2014, 6:09 PM |
| F20212: t77624b.patch | |
| Dec 9 2014, 5:35 PM |
| F20119: t77624b.patch | |
| Dec 8 2014, 11:52 PM |
| F19980: t77624.patch | |
| Dec 8 2014, 6:45 PM |
I was re-reviewing some parser functions, and found that the Listing extension allows arbitrary urls, including "javascript:", etc.
E.g.,
<buy name="asdf" url="javascript:alert(1)" >anything</buy>
And the name parameter is vulnerable to reflected/stored xss:
<buy name="<scriupt>alert(2)</script>">anything</buy>
Patch seems to work for the 'url' parameter. But the 'name' field allows HTML injection too:
<buy name="<script>alert(2)</script>" >anything</buy>
The others look safe enough, unless you can do something malicious with a url prepended with "mailto:".
Thanks Brad!
The others look safe enough, unless you can do something malicious with a url prepended with "mailto:".
I think that one is ok
Looks good to me, +1. Although you might want to mention the 'name' thing in the commit message too.