XSS in bugs.python.org 404 error page

[hannob]

BPO	36391
Nosy	@hannob

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2019-03-21.14:38:01.389>
created_at = <Date 2019-03-21.14:22:10.891>
labels = ['type-security', 'docs']
title = 'XSS in bugs.python.org 404 error page'
updated_at = <Date 2019-03-21.14:38:01.386>
user = 'https://github.com/hannob'

bugs.python.org fields:

activity = <Date 2019-03-21.14:38:01.386>
actor = 'SilentGhost'
assignee = 'docs@python'
closed = True
closed_date = <Date 2019-03-21.14:38:01.389>
closer = 'SilentGhost'
components = ['Documentation']
creation = <Date 2019-03-21.14:22:10.891>
creator = 'hanno'
dependencies = []
files = []
hgrepos = []
issue_num = 36391
keywords = []
message_count = 2.0
messages = ['338543', '338545']
nosy_count = 2.0
nosy_names = ['SilentGhost', 'hanno']
pr_nums = []
priority = 'normal'
resolution = 'third party'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue36391'
versions = []

[hannob]

There's an XSS on the 404 error page:

https://bugs.python.org/%3Cimg%20src=x%20onerror=alert(1)%3E

(For lack of a webpage / bug tracker category I chose "Documentation" as the closest category I could find)

[SilentGhost]

Thanks for the report, Hanno. The active bugtracker for this instance seems to be available at https://github.com/python/bugs.python.org/issues (not that anything gets done there, but it won't be here either).