Bug 809006 - Double escaping html strings
Summary: Double escaping html strings
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise MRG
Classification: Red Hat
Component: cumin
Version: Development
Hardware: Unspecified
OS: Unspecified
low
medium
Target Milestone: 2.3
: ---
Assignee: Chad Roberts
QA Contact: Stanislav Graf
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-04-02 08:19 UTC by Stanislav Graf
Modified: 2013-05-23 13:22 UTC (History)
3 users (show)

Fixed In Version: cumin-0.1.5492-1
Doc Type: Bug Fix
Doc Text:
Cause: Strings containing special XML characters were being double-escaped. Consequence: Text containing special XML characters was being displayed incorrectly. Fix: Our xml_escape routine is now preventing double-escaping. Result: Strings that contain special XML characters should now display correctly.
Clone Of:
Environment:
Last Closed: 2013-03-06 18:43:28 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 438142 1 None None None 2021-01-20 06:05:38 UTC
Red Hat Bugzilla 966538 1 None None None 2021-01-20 06:05:38 UTC
Red Hat Product Errata RHSA-2013:0564 0 normal SHIPPED_LIVE Low: Red Hat Enterprise MRG Grid 2.3 security update 2013-03-06 23:37:09 UTC

Internal Links: 438142 966538

Description Stanislav Graf 2012-04-02 08:19:32 UTC 
Description of problem:
During verification of Bug 438142
I found possible double escaping in Messaging › amqp-broker › Queue

Version-Release number of selected component (if applicable):
cumin-0.1.5192-3.el5.noarch
cumin-0.1.5192-4.el6.noarch

How reproducible:
100%

Steps to Reproduce:
1. Messaging › amqp-broker
2. Add queue - <script>alert(1)</script>
3. Look into queue details
  
Actual results:
&lt;script&gt;alert(1)&lt;/script&gt;

Expected results:
<script>alert(1)</script>

Additional info:
Comment 1 Stanislav Graf 2012-04-02 09:03:01 UTC 
The same with drilling into submitted job. 'Details tab' with queue name or job description looks ok, but Breadcrumbs above are broken.
Comment 3 Trevor McKay 2012-04-02 10:21:29 UTC 
(In reply to comment #1)
> The same with drilling into submitted job. 'Details tab' with queue name or job
> description looks ok, but Breadcrumbs above are broken.

Yes, this is probably a bug.  This comes under my comment from 438142:

"There are a few other places where I inadvertently created double escapes, like
breadcrumbs, however these are harder to track down and no legitimate objects
are at all likely to contain <, &, or > anyway so the double escape doesn't
really matter."
Comment 4 Stanislav Graf 2012-04-03 08:12:37 UTC 
Also present in 
Go to cumin-grid-configuration-'Create tag'
Comment 5 Trevor McKay 2012-07-25 20:05:22 UTC 
Changed the title of this BZ.

This is a general problem that I believe can be handled in the xml_escape() routine itself.  The code needs to check for escape sequences in the string passed in and act accordingly.
Comment 6 Chad Roberts 2012-09-18 19:54:13 UTC 
Fixed in trunk revision 5470.
Comment 10 Stanislav Graf 2013-01-10 13:27:04 UTC 
Tested on RHEL 5/6 i386/x86_64
cumin-0.1.5648-1

Comment 0
Comment 1 - Job submission is sanitized for XML special characters
Comment 4

--> VERIFIED
Comment 12 errata-xmlrpc 2013-03-06 18:43:28 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0564.html
Note You need to log in before you can comment on or make changes to this bug.