Status: New
Owner: ----
Labels: Type-Defect Priority-Medium

New issue 3406 by uchida...@gmail.com: output json without html entity escape in script tag
http://code.google.com/p/reviewboard/issues/detail?id=3406

*** READ THIS BEFORE POSTING!
***
*** You must complete this form in its entirety, or your bug report will be
rejected.
***
*** For customer support, please post to reviewbo...@googlegroups.com
***
*** If you have a patch, please submit it to
http://reviews.reviewboard.org/
***
*** Do not post confidential information in this bug report!


What version are you running?


What's the URL of the page containing the problem?
https://reviews.reviewboard.org/r/5570/diff/

What steps will reproduce the problem?
1. The name change to "</script><script>alert</scritp>".
2. Add comment for review diff.
3. When view diff, pop up alert.

What is the expected output? What do you see instead?


What operating system are you using? What browser?


Please provide any additional information below.

`{"name": "</script><script> alert(1)</script>"}` is valid josn.
But it output into script tag
```
<script>
var json = {"name": "</script><script> alert(1)</script>"};
</script>
```

same this
```
<script>
var json = {"name": "
</script>

<script> alert(1)</script>

"};</script>
```

https://code.google.com/p/reviewboard/source/browse/trunk/reviewboard/reviews/templatetags/reviewtags.py#154
https://code.google.com/p/reviewboard/source/browse/trunk/reviewboard/reviews/templatetags/reviewtags.py#202

I think the characters &, < and > should be escaped in result from simplejson.dumps, or use JSONEncoderForHTML.
https://github.com/simplejson/simplejson/blob/master/simplejson/encoder.py#L353

--
You received this message because this project is configured to send all issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

--
You received this message because you are subscribed to the Google Groups 
"reviewboard-issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to reviewboard-issues+unsubscr...@googlegroups.com.
To post to this group, send email to reviewboard-issues@googlegroups.com.
Visit this group at http://groups.google.com/group/reviewboard-issues.
For more options, visit https://groups.google.com/d/optout.

Reply via email to