XSS in HTML report output

[Travis McPeak]

The following Python code snippet will cause script execution when a HTML report is generated and viewed:

import subprocess
subprocess.Popen("<script>alert(1)</script>", shell=True)

This is because the HTML formatter is failing to HTML escape the code snippets. We need to investigate the best standard library (or OpenStack condoned library) to HTML escape and then apply that to the issue text.

[Travis McPeak (travis-mcpeak)]

Alright guys, what's the best way to HTML escape? We should roll a new release for this ASAP.

[Stanislaw Pitucha (viraptor-gmail)]

cgi.escape, see
https://github.com/HewlettPackard/reconbf/commit/bc2e79f94724fe9953f70ee1e5e3a138147fdd41

I'll do the patch Monday morning unless someone wants to one the weekend?

[Tim Kelsey (tim-kelsey)]

OK, Stan made the patch to fix this but was unable to make a release so I have done so.We should probably try to handle this sort of stuff in a more organised way going forward but bandit 1.1.0 is out now (also has new test for httpoxy).

[Tim Kelsey (tim-kelsey)]

Bump in req's https://review.openstack.org/#/c/355444/

[Ian Cordasco (icordasc)]

We should open this up now that the fix has been merged and released.

[Tim Kelsey (tim-kelsey)]

yup, done

[Tim Kelsey (tim-kelsey)]

I have opened an OSSN to cover this as well

[Luke Hinds (lhinds)]

This has been published as OSSN-0070:

https://wiki.openstack.org/wiki/OSSN/OSSN-0070

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ian Cordasco (<email address hidden>) on branch: stable/0.17.0
Review: https://review.openstack.org/355294