Bug 35275

Summary:

XSS при разборе changelog

Product:

Infrastructure

Reporter:

Ivan A. Melnikov <iv>

Component:

packages.altlinux.org

Assignee:

Nobody's working on this, feel free to take it <nobody>

Status:

CLOSED FIXED

QA Contact:

Severity:

normal

Priority:

CC:

mike, rider

Version:

unspecified

Hardware:

all

OS:

Linux

Bug Depends on:

Bug Blocks:

22555

Attachments:

Description	Flags
Скриншот	none

Description Ivan A. Melnikov 2018-08-21 09:19:16 MSK

Теги из %changelog не экранируются и интерпретируются браузером.

Пример:

https://packages.altlinux.org/en/Sisyphus/srpms/alterator-alternatives/changelog

Тот самый entry:
* Tue Nov 18 2008 Vladislav Zavjalov <slazav at altlinux.org> 1.0-alt3
- remove <title> and <h1> from html template

Comment 1 Ivan A. Melnikov 2018-08-21 09:20:41 MSK

Created attachment 7713 [details]
Скриншот

Comment 2 Ivan A. Melnikov 2018-09-11 12:29:45 MSK

Ещё один пример: https://packages.altlinux.org/en/Sisyphus/srpms/alt-docs-genextras

* Thu Apr 17 2008 Kirill Maslinsky <kirill@altlinux.org> 0.3-alt5
- bugfix (#12466, #13742)
- usability: issue absracts separated visually with <HR> (azol@)

Comment 3 Anton Farygin 2021-11-10 12:10:12 MSK

Исправлено на https://beta.packages.altlinux.org