Comment 27 for bug 1308727

Revision history for this message
Julie Pichon (jpichon) wrote : Re: XSS in Horizon Heat template - resource name (CVE-2014-3473)

Thank you for the feedback everyone, and sorry for the delay in replying. I'm attaching a new patch that should resolve the Javascript issue Gabriel brought up. This very probably should be refactored into a function later on but I don't see any obvious place where it should live at the moment, and it seems to me the refactoring discussion would be better handled in a regular gerrit review afterwards.

With regard to your comment Kieran, I can indeed reproduce when calling a resource with only a "javascript:" name (then the alert happens when clicking on the link rather than when loading the page). Using reverse to generate URLs is likely safer but appears to be more awkward because the resource URL requires also the stack_id, which isn't accessible from the resource object itself. It is however visible in the "links" dictionary that contains direct heat URLs so playing a bit with regexes we could manage to generate the URL correctly for both the Events and Resources tables:

def generate_resource_url(obj):
    for link in getattr(obj, 'links', []):
        if link.get('rel', None) == "stack":
            url = link.get('href', '')
            m = re.search("/stacks/\w+/([\w-]+)", url)
            if m is not None:
                stack_id = m.group(1)
                return urlresolvers.reverse('horizon:project:stacks:resource',
                                            args=(stack_id, obj.resource_name))
    else:
        return None

It feels a bit awkward though. Unfortunately I don't have a lot of time to spend on this at the moment, if someone else wants to look into it please feel free to pick it up. If there's feedback in the next couple of days I'll do my best to address it, otherwise it'll have to wait until next week as I'll be out of office later on. Thanks again for the feedback.