Bug 35275 - XSS при разборе changelog
Summary: XSS при разборе changelog
Status: CLOSED FIXED
Alias: None
Product: Infrastructure
Classification: Infrastructure
Component: packages.altlinux.org (show other bugs)
Version: unspecified
Hardware: all Linux
: P3 normal
Assignee: Nobody's working on this, feel free to take it
QA Contact:
URL:
Keywords:
Depends on:
Blocks: 22555
  Show dependency tree
 
Reported: 2018-08-21 09:19 MSK by Ivan A. Melnikov
Modified: 2021-11-10 12:10 MSK (History)
2 users (show)

See Also:

Attachments
Скриншот (6.65 KB, image/png)
2018-08-21 09:20 MSK, Ivan A. Melnikov 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ivan A. Melnikov 2018-08-21 09:19:16 MSK 
Теги из %changelog не экранируются и интерпретируются браузером.

Пример:

https://packages.altlinux.org/en/Sisyphus/srpms/alterator-alternatives/changelog

Тот самый entry:
* Tue Nov 18 2008 Vladislav Zavjalov <slazav at altlinux.org> 1.0-alt3
- remove <title> and <h1> from html template
Comment 1 Ivan A. Melnikov 2018-08-21 09:20:41 MSK 
Created attachment 7713 [details]
Скриншот
Comment 2 Ivan A. Melnikov 2018-09-11 12:29:45 MSK 
Ещё один пример: https://packages.altlinux.org/en/Sisyphus/srpms/alt-docs-genextras

* Thu Apr 17 2008 Kirill Maslinsky <kirill@altlinux.org> 0.3-alt5
- bugfix (#12466, #13742)
- usability: issue absracts separated visually with <HR> (azol@)
Comment 3 Anton Farygin 2021-11-10 12:10:12 MSK 
Исправлено на https://beta.packages.altlinux.org