Return-Path: 
 <dev-return-34062-apmail-couchdb-dev-archive=couchdb.apache.org@couchdb.apache.org>
X-Original-To: apmail-couchdb-dev-archive@www.apache.org
Delivered-To: apmail-couchdb-dev-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id 9820D10C50
	for <apmail-couchdb-dev-archive@www.apache.org>;
 Thu,  1 May 2014 20:03:33 +0000 (UTC)
Received: (qmail 58020 invoked by uid 500); 1 May 2014 20:03:23 -0000
Delivered-To: apmail-couchdb-dev-archive@couchdb.apache.org
Received: (qmail 57790 invoked by uid 500); 1 May 2014 20:03:18 -0000
Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:dev-help@couchdb.apache.org>
List-Unsubscribe: <mailto:dev-unsubscribe@couchdb.apache.org>
List-Post: <mailto:dev@couchdb.apache.org>
List-Id: <dev.couchdb.apache.org>
Reply-To: dev@couchdb.apache.org
Delivered-To: mailing list dev@couchdb.apache.org
Received: (qmail 57713 invoked by uid 99); 1 May 2014 20:03:17 -0000
Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 01 May 2014 20:03:17 +0000
Date: Thu, 1 May 2014 20:03:17 +0000 (UTC)
From: "ASF GitHub Bot (JIRA)" <jira@apache.org>
To: dev@couchdb.apache.org
Message-ID: <JIRA.12711757.1398968294480.215037.1398974597566@arcas>
In-Reply-To: <JIRA.12711757.1398968294480@arcas>
References: <JIRA.12711757.1398968294480@arcas>
Subject: [jira] [Commented] (COUCHDB-2232) Escape HTML when rendering XSS
 targets
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


    [ https://issues.apache.org/jira/browse/COUCHDB-2232?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13986934#comment-13986934 ] 

ASF GitHub Bot commented on COUCHDB-2232:
-----------------------------------------

Github user asfgit closed the pull request at:

    https://github.com/apache/couchdb/pull/219


> Escape HTML when rendering XSS targets
> --------------------------------------
>
>                 Key: COUCHDB-2232
>                 URL: https://issues.apache.org/jira/browse/COUCHDB-2232
>             Project: CouchDB
>          Issue Type: Bug
>      Security Level: public(Regular issues) 
>          Components: Fauxton
>            Reporter: Kyle Snavely
>
> XSS payloads such as '\"><img src=%3Dx onerror%3Dprompt(%2Fxss%2F)>' can be used with malicious intent in documents.
> When rendered unescaped in Fauxton the JS is executed. To reproduce, use the above string as a new document ID in Fauxton.
> This affects the _id field of documents, normal, ddoc, replicator docs...
> Other rendered data may be affected. I noticed I can create couch users with the above string as a name.
> I have a branch with basic fixes, using <%- in place of <%= where appropriate in templates. I'm still getting my Fauxton dev stack set back up so I haven't yet run the tests or inspected things locally.
> I am not familiar with the codebase but I'd like to point out the possible sore spots. Branch notes:
>   - https://github.com/ksnavely/couchdb/compare/30460-XSS-substitutions
>   - I tried to not be super heavy handed, only using <%- for values that
>     could be set with XSS payloads or otherwise come from a user/data.
>   - There are a few spots where I wasn't sure:
>       -- src/fauxton/app/addons/config/templates/item.html
>       -- src/fauxton/app/addons/documents/templates/changes.html
>   - Perhaps safeURLName can escape on <, > as well?
>       -- https://github.com/apache/couchdb-fauxton/blob/4ab2cde647b7712e262f8e4567ae835deff66a8c/app/core/utils.js#L85
> I'll do another run through looking for '<%=' and updating as appropriate.



--
This message was sent by Atlassian JIRA
(v6.2#6252)