(CVE-2013-0785) [SECURITY] XSS in show_bug.cgi when using an invalid page format

<https://bugzilla.mozilla.org/show_bug.cgi?id=842038>
<exp2://Ticket/14465628>

Applied "patch for 3.6 and 4.0, v1" to bugs.webkit.org.

* Bugzilla/Template.pm:
(get_format):
* show_bug.cgi:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@145301 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Websites/bugs.webkit.org/Bugzilla/Template.pm b/Websites/bugs.webkit.org/Bugzilla/Template.pm
index 1362eca..6a8a717 100644 (file)
--- a/Websites/bugs.webkit.org/Bugzilla/Template.pm
+++ b/Websites/bugs.webkit.org/Bugzilla/Template.pm
@@ -147,6 +147,7 @@ sub get_format {
     return
     {
         'template'    => $template,
+        'format'      => $format,
         'extension'   => $ctype,
         'ctype'       => Bugzilla::Constants::contenttypes->{$ctype}
     };

diff --git a/Websites/bugs.webkit.org/ChangeLog b/Websites/bugs.webkit.org/ChangeLog
index 6beebbc..466176f 100644 (file)
--- a/Websites/bugs.webkit.org/ChangeLog
+++ b/Websites/bugs.webkit.org/ChangeLog
@@ -1,3 +1,15 @@
+2013-03-08  David Kilzer  <ddkilzer@apple.com>
+
+        (CVE-2013-0785) [SECURITY] XSS in show_bug.cgi when using an invalid page format
+        <https://bugzilla.mozilla.org/show_bug.cgi?id=842038>
+        <exp2://Ticket/14465628>
+
+        Applied "patch for 3.6 and 4.0, v1" to bugs.webkit.org.
+
+        * Bugzilla/Template.pm:
+        (get_format):
+        * show_bug.cgi:
+
 2013-02-01  Nathan de Vries  <ndevries@apple.com>
 
         Allow prettify.rb to be run from any directory, and don't hard-code the system ruby path

diff --git a/Websites/bugs.webkit.org/show_bug.cgi b/Websites/bugs.webkit.org/show_bug.cgi
index 3bc5cd4..716a11e 100755 (executable)
--- a/Websites/bugs.webkit.org/show_bug.cgi
+++ b/Websites/bugs.webkit.org/show_bug.cgi
@@ -37,9 +37,11 @@ my $vars = {};
 
 my $user = Bugzilla->login();
 
+my $format = $template->get_format("bug/show", scalar $cgi->param('format'),
+                                   scalar $cgi->param('ctype'));
+
 # Editable, 'single' HTML bugs are treated slightly specially in a few places
-my $single = !$cgi->param('format')
-  && (!$cgi->param('ctype') || $cgi->param('ctype') eq 'html');
+my $single = !$format->{format} && $format->{extension} eq 'html';
 
 # If we don't have an ID, _AND_ we're only doing a single bug, then prompt
 if (!$cgi->param('id') && $single) {
@@ -49,9 +51,6 @@ if (!$cgi->param('id') && $single) {
     exit;
 }
 
-my $format = $template->get_format("bug/show", scalar $cgi->param('format'), 
-                                   scalar $cgi->param('ctype'));
-
 my @bugs = ();
 my %marks;
 
@@ -138,5 +137,5 @@ $vars->{'displayfields'} = \%displayfields;
 
 print $cgi->header($format->{'ctype'});
 
-$template->process("$format->{'template'}", $vars)
+$template->process($format->{'template'}, $vars)
   || ThrowTemplateError($template->error());