URL auto-linking linkifies data: URLs
Bug #1021129 reported by
William Grant
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Launchpad itself |
Fix Released
|
Critical
|
Curtis Hovey |
Bug Description
Bug #276726 asked that data: URLs be linkified, and it was made so. But the bug was misguided; data: links, at least in Firefox, execute within the origin of the page that contains them. So you can XSS nicely by providing a data:text/
Related branches
lp:~sinzui/launchpad/frou-frou-foxes
(Merged)
Changed in launchpad: | |
assignee: | nobody → Curtis Hovey (sinzui) |
status: | Triaged → In Progress |
tags: |
added: qa-ok removed: qa-needstesting |
Changed in launchpad: | |
status: | Fix Committed → Fix Released |
visibility: | private → public |
tags: | added: disclosure |
To post a comment you must log in.
Fixed in stable r15581 <http:// bazaar. launchpad. net/~launchpad- pqm/launchpad/ stable/ revision/ 15581>.