Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

fix XSS vulnerability in conversations#new, closes #4010

  • Loading branch information...
commit d6ff67fde2e4b48e83f3ec17714740d133c90b6a 1 parent 4a92508
@jhass jhass authored
View
4 Changelog.md
@@ -1,3 +1,7 @@
+# 0.0.3.2
+
+* Fix XSS vulnerability in conversations#new [#4010](https://github.com/diaspora/diaspora/issues/4010)
+
# 0.0.3.1
* exec foreman in ./script/server to replace the process so that we can Ctrl+C it again.
View
2  app/views/conversations/new.haml
@@ -20,7 +20,7 @@
keyDelay: 0,
startText: '',
emptyText: '#{t('no_results')}',
- preFill: [{name : "#{params[:name]}",
+ preFill: [{name : "#{h params[:name]}",
value : "#{@contact_ids}"}]
});
autocompleteInput.focus();
View
2  config/defaults.yml
@@ -4,7 +4,7 @@
defaults:
version:
- number: "0.0.3.1"
+ number: "0.0.3.2"
heroku: false
environment:
url: "http://localhost:3000/"
View
8 spec/controllers/conversations_controller_spec.rb
@@ -33,6 +33,14 @@
get :new, :aspect_id => alice.aspects.first.id
assigns(:contact_ids).should == alice.aspects.first.contacts.map(&:id).join(',')
end
+
+ it "does not allow XSS via the name parameter" do
+ ["</script><script>alert(1);</script>",
+ '"}]});alert(1);(function f() {var foo = [{b:"'].each do |xss|
+ get :new, name: xss
+ response.body.should_not include xss
+ end
+ end
end
describe '#index' do
Please sign in to comment.
Something went wrong with that request. Please try again.