Commit 564fb684 authored by Frédéric Buclin's avatar Frédéric Buclin

Bug 842038: (CVE-2013-0785) [SECURITY] XSS in show_bug.cgi when using an invalid page format

r=glob a=LpSolit
parent e2c8da0d
......@@ -96,12 +96,15 @@ sub get_format {
my $self = shift;
my ($template, $format, $ctype) = @_;
$ctype ||= 'html';
$format ||= '';
$ctype //= 'html';
$format //= '';
# Security - allow letters and a hyphen only
$ctype =~ s/[^a-zA-Z\-]//g;
$format =~ s/[^a-zA-Z\-]//g;
# ctype and format can have letters and a hyphen only.
if ($ctype =~ /[^a-zA-Z\-]/ || $format =~ /[^a-zA-Z\-]/) {
ThrowUserError('format_not_found', {'format' => $format,
'ctype' => $ctype,
'invalid' => 1});
}
trick_taint($ctype);
trick_taint($format);
......@@ -127,6 +130,7 @@ sub get_format {
return
{
'template' => $template,
'format' => $format,
'extension' => $ctype,
'ctype' => Bugzilla::Constants::contenttypes->{$ctype}
};
......
......@@ -22,9 +22,11 @@ my $vars = {};
my $user = Bugzilla->login();
my $format = $template->get_format("bug/show", scalar $cgi->param('format'),
scalar $cgi->param('ctype'));
# Editable, 'single' HTML bugs are treated slightly specially in a few places
my $single = !$cgi->param('format')
&& (!$cgi->param('ctype') || $cgi->param('ctype') eq 'html');
my $single = !$format->{format} && $format->{extension} eq 'html';
# If we don't have an ID, _AND_ we're only doing a single bug, then prompt
if (!$cgi->param('id') && $single) {
......@@ -34,9 +36,6 @@ if (!$cgi->param('id') && $single) {
exit;
}
my $format = $template->get_format("bug/show", scalar $cgi->param('format'),
scalar $cgi->param('ctype'));
my (@bugs, @illegal_bugs);
my %marks;
......@@ -126,5 +125,5 @@ $vars->{'displayfields'} = \%displayfields;
print $cgi->header($format->{'ctype'});
$template->process("$format->{'template'}", $vars)
$template->process($format->{'template'}, $vars)
|| ThrowTemplateError($template->error());
......@@ -741,7 +741,10 @@
[% title = "Format Not Found" %]
The requested format <em>[% format FILTER html %]</em> does not exist with
a content type of <em>[% ctype FILTER html %]</em>.
[% IF invalid %]
Both parameters must contain letters and hyphens only.
[% END %]
[% ELSIF error == "flag_type_sortkey_invalid" %]
[% title = "Flag Type Sort Key Invalid" %]
The sort key <em>[% sortkey FILTER html %]</em> must be an integer
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment