Wolfe, Jeff wrote:
Hi All,
I apologize if this isn't the place to report this, but an colleague and I
uncovered a cross site scripting bug that seems to be in the 1.5 branch.
I've seen it in 1.5b4. Exploiting it easy. The contents of the search box
are placed verbatim on the search results page. This means you can place
any HTML you want in the search and up it comes. Since the search
parameters are passed on the URL, it's a no-brainer to create an URL with
offending content. Add the following URL to any 1.5b4 site and you should
see a java script alert box pop up:
<snip>
I have not seen this earlier than the 1.5 branch, and
it would seem
Wikipedia and a few others are doing something different from the default
which prevents the issue. One simple workaround is to change the
'searchquery' message to not use the $1 parameter for now.
Fixed it by using Sanitizer::removeHTMLtags on the 'search' input. It
fixes the issue but might have a side effect somewhere.
I commited the patch in REL1_5 and HEAD.
--
Ashar Voultoiz - WP++++
http://en.wikipedia.org/wiki/User:Hashar
http://www.livejournal.com/community/wikitech/
IM: hashar(a)jabber.org ICQ: 15325080