Can not delete container with XSS-injected name

Bug #1469147 reported by Vlad Okhrimenko
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Dashboard (Horizon)
Fix Released
Wishlist
Kuo-tung Kao (jelly)

Bug Description

Steps:
1. Login to Horizon Dashboard as admin user.
2. Navigate to Project -> Object Store -> Containers page.
3. Create Containers with names:
    3.1 '';!--"<XSS>=&{()}
    3.2 <IMG SRC="javascript:alert('XSS');">
    3.3 <IMG SRC=javascript:alert('XSS')>

4. Try to delete these containers --- they can't be removed

Changed in horizon:
assignee: nobody → jelly (coding1314)
Matthias Runge (mrunge)
Changed in horizon:
importance: Undecided → Wishlist
Changed in horizon:
status: New → In Progress
Revision history for this message
Kuo-tung Kao (jelly) (coding1314) wrote :

I send a patch for the bug.
https://review.openstack.org/198281

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to horizon (master)

Reviewed: https://review.openstack.org/198281
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=41d7e0d730ea6f9220f77e31cf7b48875b0ec3e9
Submitter: Jenkins
Branch: master

commit 41d7e0d730ea6f9220f77e31cf7b48875b0ec3e9
Author: Kuo-tung Kao <email address hidden>
Date: Fri Jul 3 17:45:35 2015 +0800

    delete failed when object id with special char.

    Can not delete container or object when their id with special char
    like "'", "_".

    example name:

    1. '';!--"<XSS>=&{()}
    2. <IMG SRC="javascript:alert('XSS');">

    Change-Id: Ied2704052e2fce9e82c0f94cf12b77bf4adc3c89
    Closes-Bug: #1469147

Changed in horizon:
status: In Progress → Fix Committed
Changed in horizon:
milestone: none → liberty-2
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in horizon:
milestone: liberty-2 → 8.0.0
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.