プロジェクト

全般

プロフィール

編集 操作
リンクをコピー

Vote #81009

完了

Inline issue auto complete doesn't sanitize HTML tags

Admin Redmine さんが約4年前に追加. 約4年前に更新.

ステータス:
Closed
優先度:
通常
担当者:
-
カテゴリ:
Security_51
対象バージョン:
4.1.2_162
開始日:
2022/05/09
期日:
進捗率:

0%

予定工数:
Redmineorg_URL:
https://www.redmine.org/issues/33846
category_id:
51
version_id:
162
issue_org_id:
33846
author_id:
11395
assigned_to_id:
332
comments:
19
status_id:
5
tracker_id:
1
plus1:
0
affected_version:
closed_on:
affected_version_id:
160
ステータス-->[Closed] 
引用

説明

If referring a issue that have a HTML tag in subject, the tag is rendered as an object in the auto complete tip.

To reproduce

Create one issue with a subject like @Test tag@
  • We display a @select@ object rendered in the tip, like image bellow

    • !tip.png!

    This can be dangerous,as some one can inject HTML

    journals

    --------------------------------------------------------------------------------

    --------------------------------------------------------------------------------
    Fernando, thanks for catching this.

    I've attached a patch to fix this issue.
    --------------------------------------------------------------------------------

    --------------------------------------------------------------------------------
    Marius BALTEANU wrote:
    > I've attached a patch to fix this issue.

    Thank you for fixing the issue but I see @<span>@ tags when using auto-complete by issue subject.

    !{width: 502px; border: 1px solid grey;}.autocomplete-by-title.png!
    --------------------------------------------------------------------------------
    Thanks for pointing this out, I was able to reproduce the problem. I will post soon a fix.
    --------------------------------------------------------------------------------
    Please try this new version, it should work as expected with one mention: the letters that match the search are no longer highlighted.

    !{border: 1px solid grey; width: 50%}.tribute.png!

    Also, instead of the @sanitzeHTML@ function, I think it's better to use a library like https://lodash.com/docs/4.17.15#escape, but I'm not sure how to add it without copying the code or by using a module bundler like webpack. @Jean-Philippe, any recommendations on this?
    --------------------------------------------------------------------------------
    This one works on IE 11 as well.
    --------------------------------------------------------------------------------
    Attached is a test for this issue that can be applied only after #34123 is committed.
    --------------------------------------------------------------------------------

    --------------------------------------------------------------------------------

    --------------------------------------------------------------------------------

    --------------------------------------------------------------------------------

    --------------------------------------------------------------------------------

    --------------------------------------------------------------------------------
    Update the patch for the latest trunk (r20791).
    --------------------------------------------------------------------------------
    Committed the fix. Thank you all for your contribution.
    --------------------------------------------------------------------------------

    --------------------------------------------------------------------------------
    By the way: this a full-blown XSS vulnerability. With an issue subject such as

    <pre>
    <span onmouseover="alert('pwned');">This is some exciting text</span>
    </pre>

    arbitrary Javascript can be executed (as well as arbitrary HTML code shown). In my opinion, the assessment of the issue in [[Security_Advisories]] should therefore be increased to High.
    --------------------------------------------------------------------------------
    Holger Just wrote:
    > By the way: this a full-blown XSS vulnerability. With an issue subject such as
    >
    > [...]
    >
    > arbitrary Javascript can be executed (as well as arbitrary HTML code shown). In my opinion, the assessment of the issue in [[Security_Advisories]] should therefore be increased to High.

    Thanks Holger, I've changed to High.
    --------------------------------------------------------------------------------

    related_issues

    relates,Closed,31989,Inline issue auto complete (#) in fields with text-formatting enabled

    操作
    リンクをコピー
     #1

    Admin Redmine さんが約4年前に更新

    • カテゴリ を Security_51 にセット
    • 対象バージョン を 4.1.2_162 にセット
    編集 操作
    リンクをコピー

    他の形式にエクスポート: Atom PDF

    いいね!0
    いいね!0

    demo1.unofficial-redmine.org