XSS vulnerability

.

Wed, 18 Nov 2009 06:48:28 +0000

How about this?

Tue, 24 Nov 2009 05:17:35 +0000

How about this?

Attachments are not private anyway. :) Your patch seems t

Tue, 24 Nov 2009 23:39:37 +0000

Attachments are not private anyway. :) Your patch seems to do its job, attached is a test case. I'm not sure how far Firefox can be tricked to consider a link as a data scheme. I'm thinking of variants of "data:text/html".

Don't forget about other content types. For example, if the

Wed, 25 Nov 2009 13:20:45 +0000

Don't forget about other content types. For example, if the data is the base64 encoding of: Test Then, the attacker can also use a link with the following URI: data:application/xhtml+xml;base64, And this is not the only one. If the use the content types text/xml or application/xml, the page will be parsed as a xml document. In the script, document has now type XMLDocument, and doesn't have the property cookie. We can still write something like: The same for application/xml, or more elaborate code to take care of various cases. I just tested this four cases, text/html, text/xml, application/xml, application/xhtml+xml and I don't know if there are others. I don't have a better suggestion for you, so I just leave the comment that blacklisting can be dangerous. Thank you for your time. > Attachments are not private anyway. :) > > Your patch seems to do its job, attached is a test case. > > I'm not sure how far Firefox can be tricked to consider a link as a > data scheme. I'm thinking of variants of "data:text/html".

> I don't have a better suggestion for you, so I just leave

Thu, 26 Nov 2009 00:24:07 +0000

> I don't have a better suggestion for you, so I just leave the comment > that blacklisting can be dangerous. Of course attempting to blacklist HTML attributes/elements to fix all security issues is dangerous. That is why we disable HTML inline viewing by default. But a large portion of users want/need this inline display and are willing to view these parts even with the understanding that the filtering may not be 100% accurate. That being said, thanks for your examples. It is clear that we need to filter *any* data information contained in the href parameter. I'm going to go ahead and add this to git and CVS FW_3. Will leave this ticket open for a few days for additional feedback.

Changes have been made in Git for this ticket: Bug #8715: F

Thu, 26 Nov 2009 00:28:32 +0000

Changes have been made in Git for this ticket: Bug #8715: Fix XSS vulnerability. create mode 100644 framework/Text_Filter/test/Horde/Text/Filter/fixtures/xss96.html http://git.horde.org/diff.php/framework/Text_Filter/lib/Horde/Text/Filter/Xss.php?rt=horde-git&r1=b985abda1822ab9fde68d9e4dc7dcd16b6d6ebbc&r2=14d802ae6bf6ae4e7d8721deeb3fd7ffab66a97a http://git.horde.org/diff.php/framework/Text_Filter/package.xml?rt=horde-git&r1=f40aebaffdde11d95282b77c9ca7018cffcb61dd&r2=14d802ae6bf6ae4e7d8721deeb3fd7ffab66a97a http://git.horde.org/co.php/framework/Text_Filter/test/Horde/Text/Filter/fixtures/xss96.html?rt=horde-git&r=14d802ae6bf6ae4e7d8721deeb3fd7ffab66a97a http://git.horde.org/diff.php/framework/Text_Filter/test/Horde/Text/Filter/xss.phpt?rt=horde-git&r1=8459795203b644a096720099c4f22d4cdc39dc49&r2=14d802ae6bf6ae4e7d8721deeb3fd7ffab66a97a

Changes have been made in CVS for this ticket: Bug: 8715 ch

Thu, 26 Nov 2009 00:35:31 +0000

Changes have been made in CVS for this ticket: Bug: 8715 changelog http://cvs.horde.org/diff.php/horde/docs/CHANGES?rt=horde&r1=1.1288&r2=1.1289&ty=u

Changes have been made in CVS for this ticket: Bug: 8715 Fi

Thu, 26 Nov 2009 00:38:42 +0000

Changes have been made in CVS for this ticket: Bug: 8715 Fix XSS vulnerability. http://cvs.horde.org/diff.php/framework/Text_Filter/Filter/Attic/xss.php?rt=horde&r1=1.1.2.18&r2=1.1.2.19&ty=u http://cvs.horde.org/diff.php/horde/docs/CHANGES?rt=horde&r1=1.515.2.583&r2=1.515.2.584&ty=u

Hi, Attached a patch in case the link has two hrefs with

Mon, 19 Apr 2010 16:18:41 +0000

Hi, Attached a patch in case the link has two hrefs with data URLs

> Hi, > > Attached a patch in case the link has two hrefs

Mon, 19 Apr 2010 17:47:04 +0000

> Hi, > > Attached a patch in case the link has two hrefs with data URLs This patch is not working for all cases, but this new version of the patch it's working, at least for me.

Fixed in Git and Horde 3.3.9. Git commit: http://lists.h

Tue, 04 May 2010 05:14:02 +0000

Fixed in Git and Horde 3.3.9. Git commit: http://lists.horde.org/archives/commits/2010-May/003766.html FW_3 CVS commit: http://cvs.horde.org/diff.php/framework/Text_Filter/Filter/Attic/xss.php?sa=1&r1=1.1.2.19&r2=1.1.2.20