Bug#346255: Javascript and HTML injection on http://qa.debian.org/developer.php

[Frederik Reiss]

Package: qa.debian.org
Severity: critical
Tags: security
Justification: root security hole


on http://qa.debian.org/developer.php it is possible to inject javascript and 
html tags:

http://qa.debian.org/developer.php?excuse=%3Cscript%20type=text/javascript%3Ealert(this)%3C/script%3E

-- System Information:
Debian Release: testing/unstable
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.12-bigbad
Locale: [EMAIL PROTECTED], [EMAIL PROTECTED] (charmap=UTF-8)


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Bug#346255: Javascript and HTML injection on http://qa.debian.org/developer.php

[Thijs Kinkhorst]

severity 346255 minor
thanks

Hello Frederik,

On Fri, January 6, 2006 18:18, Frederik Reiss wrote:
> on http://qa.debian.org/developer.php it is possible to inject javascript
> and html tags:
>
> http://qa.debian.org/developer.php?excuse=%3Cscript%20type=text/javascript%3Ealert(this)%3C/script%3E
>

This is not an issue since there's no valuable information stored in
cookies for that website as far as I know. Or is there?


Thijs

Bug#346255: Javascript and HTML injection on http://qa.debian.org/developer.php

[Christoph Berg]

severity 346255 grave
thanks

Re: Frederik Reiss in <[EMAIL PROTECTED]>
> Severity: critical
> Justification: root security hole

Bullshit. Downgrading.

Christoph
-- 
[EMAIL PROTECTED] | http://www.df7cb.de/


signature.asc
Description: Digital signature

Bug#346255: Javascript and HTML injection on http://qa.debian.org/developer.php

[Thijs Kinkhorst]

> [0] [EMAIL PROTECTED]:~/qa/wml 1j $cvs ci -m 'filter input for sanity (Closes:
> #346255)' developer.wml
< Checking in developer.wml;
> /org/cvs.debian.org/cvs/qa/wml/developer.wml,v  <--  developer.wml
> new revision: 1.141; previous revision: 1.140
> done

I think you might have broken something, since viewing my own DDPO doesn't
work anymore:
http://qa.debian.org/developer.php?login=kink%40squirrelmail.org&comaint=yes



Thijs

Bug#346255: Javascript and HTML injection on http://qa.debian.org/developer.php

[Christoph Berg]

Re: Thijs Kinkhorst in <[EMAIL PROTECTED]>
> I think you might have broken something, since viewing my own DDPO doesn't
> work anymore:
> http://qa.debian.org/developer.php?login=kink%40squirrelmail.org&comaint=yes

Confirmed. @ is not a valid character at the moment. I can't fix it
before Sunday evening though.

A workaround is to query by name (upper case char):

http://qa.debian.org/developer.php?login=Kinkhorst

Christoph
-- 
[EMAIL PROTECTED] | http://www.df7cb.de/


signature.asc
Description: Digital signature

Bug#346255: Javascript and HTML injection on http://qa.debian.org/developer.php

[Thijs Kinkhorst]

reopen 346255
thanks

On Sat, 2006-01-07 at 00:48 +0100, Christoph Berg wrote:
> Re: Thijs Kinkhorst in <[EMAIL PROTECTED]>
> > I think you might have broken something, since viewing my own DDPO doesn't
> > work anymore:
> > http://qa.debian.org/developer.php?login=kink%40squirrelmail.org&comaint=yes
> 
> Confirmed. @ is not a valid character at the moment. I can't fix it
> before Sunday evening though.

Ok. Since this is the way that is used to link from about any kind of
overview page, it would be nice if it could be fixed soon.


bye,
Thijs


signature.asc
Description: This is a digitally signed message part