Bug 280464: Fix XSS vulnerability in file.cgi. Wound up rewriting the whole thing from scratch as a Template Toolkit template, to make it easier to keep track of what's been escaped and what hasn't. This is a wholesale replacement.
r=bear git-svn-id: svn://10.0.0.236/trunk@217605 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
justdave%bugzilla.org
@@ -1,105 +1,38 @@
|
||||
#!/usr/bin/perl
|
||||
#!/usr/bin/perl -wT
|
||||
# -*- Mode: perl; indent-tabs-mode: nil -*-
|
||||
|
||||
# ***** BEGIN LICENSE BLOCK *****
|
||||
# Version: MPL 1.1
|
||||
#
|
||||
# The contents of this file are subject to the Netscape Public
|
||||
# License Version 1.1 (the "License"); you may not use this file
|
||||
# except in compliance with the License. You may obtain a copy of
|
||||
# the License at http://www.mozilla.org/NPL/
|
||||
# The contents of this file are subject to the Mozilla Public License Version
|
||||
# 1.1 (the "License"); you may not use this file except in compliance with the
|
||||
# License. You may obtain a copy of the License at
|
||||
# http://www.mozilla.org/MPL/
|
||||
#
|
||||
# Software distributed under the License is distributed on an "AS
|
||||
# IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
|
||||
# implied. See the License for the specific language governing
|
||||
# rights and limitations under the License.
|
||||
# Software distributed under the License is distributed on an "AS IS" basis,
|
||||
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
|
||||
# for the specific language governing rights and limitations under the
|
||||
# License.
|
||||
#
|
||||
# The Original Code is the Application Registry.
|
||||
#
|
||||
# The Initial Developer of the Original Code is Netscape Communications
|
||||
# Corporation. Portions created by Netscape are
|
||||
# Copyright (C) 1998 Netscape Communications Corporation. All
|
||||
# The Initial Developer of the Original Code is Mozilla Corporation. Portions
|
||||
# created by Mozilla Corporation are Copyright (C) 2007 Mozilla Foundation. All
|
||||
# Rights Reserved.
|
||||
#
|
||||
# Contributor(s):
|
||||
# Contributor(s): Dave Miller <justdave@mozilla.com>
|
||||
#
|
||||
# ***** END LICENSE BLOCK *****
|
||||
|
||||
require 'lloydcgi.pl';
|
||||
$|=1;
|
||||
use CGI (qw(-oldstyle_urls));
|
||||
use Template;
|
||||
|
||||
$filename= $form{"file"};
|
||||
$dirname= $form{"dir"};
|
||||
$branch= $form{"branch"};
|
||||
$cvsroot= $form{"cvsroot"};
|
||||
$rev= $form{"rev"};
|
||||
$prev_rev= $form{"prev_rev"};
|
||||
$linked_text= $form{"linked_text"};
|
||||
$linked_text = $filename if $linked_text eq '';
|
||||
my $bonsai_root = "../bonsai";
|
||||
|
||||
$branch = $rev if $branch eq '' && $rev =~ /[A-Za-z]/;
|
||||
my $cgi = new CGI;
|
||||
$cgi->charset('UTF-8');
|
||||
|
||||
@extra_url = ();
|
||||
@extra_text = ();
|
||||
my $template = new Template;
|
||||
|
||||
print "Content-type: text/html\n\n<HTML>\n";
|
||||
|
||||
print "<table border=1 cellspacing=1 cellpadding=3><tr><td>\n";
|
||||
|
||||
&load_extra_data;
|
||||
|
||||
|
||||
$i = 0;
|
||||
while( $i < @extra_text ){
|
||||
$t = $extra_text[$i];
|
||||
if( $u = $extra_url[$i] ){
|
||||
|
||||
print("<dt><a href=$u>$t</a>\n");
|
||||
}
|
||||
else {
|
||||
print("<dt>$t\n");
|
||||
}
|
||||
$i++;
|
||||
}
|
||||
|
||||
if( @extra_text ){
|
||||
print("<hr>\n");
|
||||
}
|
||||
|
||||
|
||||
$dirname2 = $dirname;
|
||||
|
||||
$dirname2 =~ s/^ns\///;
|
||||
|
||||
print "
|
||||
$linked_text
|
||||
<SPACER TYPE=VERTICAL SIZE=5>
|
||||
<dt><A HREF=../bonsai/cvsblame.cgi?file=$dirname/$filename&rev=$rev&root=$cvsroot>
|
||||
View Blame-Annotated Source</A>
|
||||
";
|
||||
if ($prev_rev ne '') {
|
||||
print "<dt><A HREF='../bonsai/cvsview2.cgi"
|
||||
."?diff_mode=context&whitespace_mode=show"
|
||||
."&root=$cvsroot&subdir=$dirname&command=DIFF_FRAMESET&file=$filename"
|
||||
."&rev1=$rev&rev2=$prev_rev'>View Diff $prev_rev vs. $rev</A>";
|
||||
} else {
|
||||
|
||||
print "<dt><A HREF='../bonsai/cvsview2.cgi?subdir=$dirname"
|
||||
."\&files=$filename\&command=DIRECTORY&branch=$branch&root=$cvsroot'>"
|
||||
."View Diff's</A>";
|
||||
}
|
||||
|
||||
print "<DT><A HREF='../bonsai/cvslog.cgi?file=$dirname/$filename&rev=$rev&root=$cvsroot'>
|
||||
View Logs</A>
|
||||
";
|
||||
|
||||
print "
|
||||
</td></tr></table>";
|
||||
|
||||
sub load_extra_data {
|
||||
local( $i, $u, $t );
|
||||
|
||||
$i = 0;
|
||||
while( ($u = $form{"u${i}"}) ne "" || $form{"t${i}"} ne "" ) {
|
||||
$t = $form{"t${i}"};
|
||||
if( $t eq "" ) {$t = $u };
|
||||
$extra_url[$i] = $u;
|
||||
$extra_text[$i] = $t;
|
||||
$i++;
|
||||
}
|
||||
}
|
||||
print $cgi->header("text/html");
|
||||
$template->process("file.html.tmpl", { bonsai_root => $bonsai_root }) || die "Couldn't process template: $@";
|
||||
|
||||
110
mozilla/webtools/registry/file.html.tmpl
Normal file
110
mozilla/webtools/registry/file.html.tmpl
Normal file
@@ -0,0 +1,110 @@
|
||||
[%# -*- Mode: perl; indent-tabs-mode: nil -*-
|
||||
|
||||
# ***** BEGIN LICENSE BLOCK *****
|
||||
# Version: MPL 1.1
|
||||
#
|
||||
# The contents of this file are subject to the Mozilla Public License Version
|
||||
# 1.1 (the "License"); you may not use this file except in compliance with
|
||||
# the License. You may obtain a copy of the License at
|
||||
# http://www.mozilla.org/MPL/
|
||||
#
|
||||
# Software distributed under the License is distributed on an "AS IS" basis,
|
||||
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
|
||||
# for the specific language governing rights and limitations under the
|
||||
# License.
|
||||
#
|
||||
# The Original Code is the Application Registry.
|
||||
#
|
||||
# The Initial Developer of the Original Code is Mozilla Corporation. Portions
|
||||
# created by Mozilla Corporation are Copyright (C) 2007 Mozilla Foundation.
|
||||
# All Rights Reserved.
|
||||
#
|
||||
# Contributor(s): Dave Miller <justdave@mozilla.com>
|
||||
#
|
||||
# ***** END LICENSE BLOCK *****
|
||||
|
||||
-%]
|
||||
[%- USE CGI;
|
||||
filename = CGI.param('file');
|
||||
dirname = CGI.param('dir');
|
||||
cvsroot = CGI.param('cvsroot');
|
||||
rev = CGI.param('rev');
|
||||
prev_rev = CGI.param('prev_rev');
|
||||
linked_text = CGI.param('linked_text');
|
||||
SET linked_text = filename IF NOT linked_text;
|
||||
branch = CGI.param('branch');
|
||||
SET branch = rev IF (NOT branch) OR rev.match('[A-Za-z]');
|
||||
extralist = [];
|
||||
i = 0;
|
||||
WHILE CGI.param("u$i") OR CGI.param("t$i");
|
||||
u = CGI.param("u$i");
|
||||
t = CGI.param("t$i");
|
||||
SET t = u IF NOT t;
|
||||
extralist.push( { url => u, text => t } );
|
||||
i = i + 1;
|
||||
END;
|
||||
-%]
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
|
||||
"http://www.w3.org/TR/html4/loose.dtd">
|
||||
<html>
|
||||
<head>
|
||||
<title>[% linked_text FILTER html %] - Registry</title>
|
||||
</head>
|
||||
<body>
|
||||
<table border="1" cellspacing="1" cellpadding="3">
|
||||
<tr>
|
||||
<td>
|
||||
[% IF extralist.size > 0 %]
|
||||
[% FOREACH extra IN extralist %]
|
||||
[% IF extra.url %]
|
||||
<a href="[% extra.url FILTER html %]">[% extra.text FILTER html %]</a><br>
|
||||
[% ELSE %]
|
||||
[% extra.text FILTER html %]<br>
|
||||
[% END %]
|
||||
[% END %]
|
||||
<hr>
|
||||
[% END %]
|
||||
[% linked_text FILTER html %]<br>
|
||||
[% FILTER null;
|
||||
cgi = CGI.new('');
|
||||
cgi.param('file', "$dirname/$filename");
|
||||
cgi.param('rev', rev);
|
||||
cgi.param('cvsroot', cvsroot);
|
||||
END; -%]
|
||||
<a href="[% "$bonsai_root/cvsblame.cgi?$cgi.query_string" FILTER html %]">View Blame-Annotated Source</a><br>
|
||||
[% IF prev_rev %]
|
||||
[% FILTER null;
|
||||
cgi = CGI.new('');
|
||||
cgi.param('diff_mode', 'context');
|
||||
cgi.param('whitespace_mode', 'show');
|
||||
cgi.param('root', cvsroot);
|
||||
cgi.param('subdir', dirname);
|
||||
cgi.param('command', 'DIFF_FRAMESET');
|
||||
cgi.param('file', filename);
|
||||
cgi.param('rev1', rev);
|
||||
cgi.param('rev2', prev_rev);
|
||||
END; -%]
|
||||
<a href="[% "$bonsai_root/cvsview2.cgi?$cgi.query_string" FILTER html %]">View Diff [% prev_rev FILTER html %] vs. [% rev FILTER html %]</a><br>
|
||||
[% ELSE %]
|
||||
[% FILTER null;
|
||||
cgi = CGI.new('');
|
||||
cgi.param('subdir', dirname);
|
||||
cgi.param('files', filename);
|
||||
cgi.param('command', 'DIRECTORY');
|
||||
cgi.param('branch', branch);
|
||||
cgi.param('root', cvsroot);
|
||||
END; -%]
|
||||
<a href="[% "$bonsai_root/cvsview2.cgi?$cgi.query_string" FILTER html %]">View Diffs</a><br>
|
||||
[% END %]
|
||||
[% FILTER null;
|
||||
cgi = CGI.new('');
|
||||
cgi.param('file', "$dirname/$filename");
|
||||
cgi.param('rev', rev);
|
||||
cgi.param('root', cvsroot);
|
||||
END; - %]
|
||||
<a href="[% "$bonsai_root/cvslog.cgi?$cgi.query_string" FILTER html %]">View Logs</a>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user