calibre vulnerable to XSS attack in book titles

[Jonathan Davies]

According to:

- http://b.fl7.de/2014/09/amazon-stored-xss-book-metadata.html

..."Not Just Amazon" section, calibre is vulnerable to XSS attacks and this was fixed upstream.

This was discovered via: http://www.hotforsecurity.com/blog/download-this-kindle-ebook-and-have-your-amazon-account-cookies-stolen-10139.html

[Jonathan Davies (jpds)]

Assuming fixed in utopic as latest version is there.

[Martin Pitt (pitti)]

I contacted the blog author (using the contact form on the blog) to ask about details of the calibre fix. I sent the following question:

------------------- 8< --------------
Hello! I'd like to check if this affects the Calibre version that is shipped in stable Debian/Ubuntu releases, and fix it there. Do you have some more information about that?

There is no Calibre 1.80 (the next release after 1.48 was 2.0), so things that would help me to identify the fix would be any of those:

 - Did you file a bug report, or just sent a mail? If it's a bug report, do you have the URL?
 - If the above is not available: When exactly did you contact upstream?
 - If the above is not available: In which calibre version did that get fixed?

Thank you!
------------------- 8< --------------

[Martin Pitt (pitti)]

Corresponding upstream bug: https://bugs.launchpad.net/calibre/+bug/1243976
I'm fairly sure this corresponds to this fix: https://github.com/kovidgoyal/calibre/commit/446c8c9676e18c4df922ad1319018f9d1a4bd047

Thus this was fixed in version 1.8.0, and trusty isn't affected.