As discussed with the vulnerability team, I'm attaching a single patch to fix the 3 XSS issues currently open against Horizon.
About the other clean-up tasks mentioned in this bug, I tried to exploit the potential vulnerability in _stack_info.html by adding things like this to the template:
outputs:
WebsiteURL:
description: A URL
value: http://"><img src=zz onerror=alert(2)>
I'd appreciate additional eyes from folks more familiar with Javascript on the network names fix, as I found the .text() behaviour fairly unintuitive. It parses HTML entities like < into their text equivalent <, making safely escaped strings vulnerable again. I haven't had a chance to investigate other places where we use text(). I'll provide the Havana version of the patch shortly.
As discussed with the vulnerability team, I'm attaching a single patch to fix the 3 XSS issues currently open against Horizon.
About the other clean-up tasks mentioned in this bug, I tried to exploit the potential vulnerability in _stack_info.html by adding things like this to the template:
outputs:
WebsiteURL:
description: A URL
value: http://"><img src=zz onerror=alert(2)>
However the strings were escaped properly and I wasn't able to. I believe this is already safe thanks to django's auto-escaping (see https:/ /docs.djangopro ject.com/ en/1.4/ topics/ templates/ #automatic- html-escaping ).
I'd appreciate additional eyes from folks more familiar with Javascript on the network names fix, as I found the .text() behaviour fairly unintuitive. It parses HTML entities like < into their text equivalent <, making safely escaped strings vulnerable again. I haven't had a chance to investigate other places where we use text(). I'll provide the Havana version of the patch shortly.