Skip to content
This repository has been archived by the owner on Jul 24, 2021. It is now read-only.

Patch to fix further XSS holes, and nicer cleaning of tags where some are suitable #635

Closed
openstreetmap-trac opened this issue Jul 23, 2021 · 5 comments

Comments

@openstreetmap-trac
Copy link

Reporter: grand.edgemaster[at]gmail.com
[Submitted to the original trac issue database at 10.25am, Tuesday, 15th January 2008]

Fixes two further XSS holes (in/outboxes) and uses the Rails 2 sanitize function to filter out nasty js based on a whitelist approach. (also handles javascript: links well)

@openstreetmap-trac
Copy link
Author

Author: grand.edgemaster[at]gmail.com
[Added to the original trac issue at 4.29pm, Tuesday, 15th January 2008]

(has been applied to and tested at http://osm.ge.pythonmoo.co.uk/user/admin/diary)

@openstreetmap-trac
Copy link
Author

Author: tom[at]compton.nu
[Added to the original trac issue at 6.17pm, Tuesday, 15th January 2008]

I actually thought older versions of rails had that stuff as well as I'm sure I looked at it. I can't see it now though. My main concern about using that stuff was all the warning notices plastered across it about it using a heuristic scanner and there being a risk of it missing things.

@openstreetmap-trac
Copy link
Author

Author: tom[at]compton.nu
[Added to the original trac issue at 6.20pm, Tuesday, 15th January 2008]

Yep - the rails book confirms that the sanitize method has always existed, it is just that it used to be blacklist based and only removed a few really had things (script and form tags, javascript links etc) and now it is whitelist based which is a bit better though it is still reliant on the HTML scanner's ability to find the tags.

@openstreetmap-trac
Copy link
Author

Author: grand.edgemaster[at]gmail.com
[Added to the original trac issue at 6.24pm, Tuesday, 15th January 2008]

Yet it is still better than the current no formatting at all method.

Although it may not catch 100%, (although from my interpretation of the docs, it has improved by a great deal with 2), it will catch the majority - I'm sure that with more rails updates, it will improve as rails does.

@openstreetmap-trac
Copy link
Author

Author: tom[at]compton.nu
[Added to the original trac issue at 6.33pm, Tuesday, 15th January 2008]

Applied. I've also added an auto_link() call to linkify any links which the user didn't tag.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant