From: gerv%gerv.net <>
Date: Tue, 4 Jan 2005 04:55:54 +0000 (+0000)
Subject: Bug 272620: avoid XSS problem with internal error messages. Patch by gerv; r=justdave... 
X-Git-Tag: bugzilla-2.18~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=280d44cfd50a082fae403bbcc181a3ee2628482a;p=thirdparty%2Fbugzilla.git

Bug 272620: avoid XSS problem with internal error messages. Patch by gerv; r=justdave; a=justdave.
---

diff --git a/Bugzilla/Error.pm b/Bugzilla/Error.pm
index e511a575c6..23e7deee9a 100644
--- a/Bugzilla/Error.pm
+++ b/Bugzilla/Error.pm
@@ -79,7 +79,10 @@ sub ThrowTemplateError {
             time this message appeared.
           </p>
           <script type="text/javascript"> <!--
-            document.write("<p>URL: " + document.location + "</p>");
+          document.write("<p>URL: " + 
+                          document.location.href.replace(/&/g,"&amp;")
+                                                .replace(/</g,"&lt;")
+                                                .replace(/>/g,"&gt;") + "</p>");
           // -->
           </script>
           <p>Template->process() failed twice.<br>
diff --git a/template/en/default/global/code-error.html.tmpl b/template/en/default/global/code-error.html.tmpl
index cbca4f1d14..91acc8f064 100644
--- a/template/en/default/global/code-error.html.tmpl
+++ b/template/en/default/global/code-error.html.tmpl
@@ -251,7 +251,10 @@
     the time this message appeared.
   </p>
   <script type="text/javascript"> <!--
-    document.write("<p>URL: " + document.location + "</p>");
+    document.write("<p>URL: " + 
+                    document.location.href.replace(/&/g,"&amp;")
+                                          .replace(/</g,"&lt;")
+                                          .replace(/>/g,"&gt;") + "</p>");
   // -->
   </script>
 </tt>