diff options
author | 2016-05-16 20:23:43 +0200 | |
---|---|---|
committer | 2016-05-16 20:23:43 +0200 | |
commit | 0cc1797afa063761ab7e547bf805b4cb85accb78 (patch) | |
tree | 35eabfae15cc8c7aa229b8e1be4072dcc38c2542 /showdependencygraph.cgi | |
parent | Bug 1269388 - Release notes for Bugzilla 5.0.3 (diff) | |
download | bugzilla-0cc1797afa063761ab7e547bf805b4cb85accb78.tar.gz bugzilla-0cc1797afa063761ab7e547bf805b4cb85accb78.tar.bz2 bugzilla-0cc1797afa063761ab7e547bf805b4cb85accb78.zip |
Bug 1253263 - (CVE-2016-2803) [SECURITY] XSS vulnerability in dependency graphs via bug summary
r/a=dkl
Diffstat (limited to 'showdependencygraph.cgi')
-rwxr-xr-x | showdependencygraph.cgi | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/showdependencygraph.cgi b/showdependencygraph.cgi index 6d4cb1e71..7b2d2f55d 100755 --- a/showdependencygraph.cgi +++ b/showdependencygraph.cgi @@ -55,13 +55,19 @@ sub CreateImagemap { $default = qq{<area alt="" shape="default" href="$1">\n}; } - if ($line =~ /^rectangle \((.*),(.*)\) \((.*),(.*)\) (http[^ ]*) (\d+)(\\n.*)?$/) { + if ($line =~ /^rectangle \((\d+),(\d+)\) \((\d+),(\d+)\) (http[^ ]*) (\d+)(?:\\n.*)?$/) { my ($leftx, $rightx, $topy, $bottomy, $url, $bugid) = ($1, $3, $2, $4, $5, $6); # Pick up bugid from the mapdata label field. Getting the title from # bugtitle hash instead of mapdata allows us to get the summary even # when showsummary is off, and also gives us status and resolution. + # This text is safe; it has already been escaped. my $bugtitle = $bugtitles{$bugid}; + + # The URL is supposed to be safe, because it's built manually. + # But in case someone manages to inject code, it's safer to escape it. + $url = html_quote($url); + $map .= qq{<area alt="bug $bugid" name="bug$bugid" shape="rect" } . qq{title="$bugtitle" href="$url" } . qq{coords="$leftx,$topy,$rightx,$bottomy">\n}; |