From: gerv%gerv.net <>
Date: Tue, 4 Jan 2005 05:02:10 +0000 (+0000)
Subject: Bug 272620: avoid XSS problem with internal error messages. Patch by wurblzap@gmail... 
X-Git-Tag: bugzilla-2.16.8~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b0a3eb32d59c8b0d54c5005bb2d6440eb521b9bb;p=thirdparty%2Fbugzilla.git

Bug 272620: avoid XSS problem with internal error messages. Patch by wurblzap@gmail.com; r=gerv; a=justdave.
---

diff --git a/CGI.pl b/CGI.pl
index dd48110426..5326e129d7 100644
--- a/CGI.pl
+++ b/CGI.pl
@@ -965,7 +965,11 @@ sub ThrowTemplateError {
             time this message appeared.
           </p>
           <script> <!--
-            document.write("<p>URL: " + document.location + "</p>");
+            document.write("<p>URL: " +
+                           document.location.href.replace(/&/g, "&amp;")
+                                                 .replace(/</g, "&lt;")
+                                                 .replace(/>/g, "&gt;") +
+                           "</p>");
           // -->
           </script>
           <p>Template->process() failed twice.<br>
diff --git a/template/en/default/global/code-error.html.tmpl b/template/en/default/global/code-error.html.tmpl
index cab4f44b8a..5274be5fc4 100644
--- a/template/en/default/global/code-error.html.tmpl
+++ b/template/en/default/global/code-error.html.tmpl
@@ -37,7 +37,11 @@
     the time this message appeared.
   </p>
   <script> <!--
-    document.write("<p>URL: " + document.location + "</p>");
+    document.write("<p>URL: " +
+                   document.location.href.replace(/&/g, "&amp;")
+                                         .replace(/</g, "&lt;")
+                                         .replace(/>/g, "&gt;") +
+                   "</p>");
   // -->
   </script>
 </tt>