RE: [BUG] gitweb: XSS vulnerability of RSS feed

-----Original Message-----
From: Drew Northup
Sent: Monday, November 12, 2012 1:56 PM

On Sun, Nov 11, 2012 at 6:28 PM, glpk xypron [off-list ref]
wrote:

quoted

Gitweb can be used to generate an RSS feed.

Arbitrary tags can be inserted into the XML document describing
the RSS feed by careful construction of the URL.

Example

http://server/?p=project.git&a=rss&f=</title><script>alert(document.coo
kie)</script><title>

quoted

The generated XML contains
<script>alert(document.cookie)</script>

This is just an example.

quoted

Depending on the system used to render the XML this might lead
to the execution of javascript in the security context of the
gitweb server pages.

Please, escape all URL parameters.

We should look for the general entry points, not the script tag.

### not real perl...
foreach $xml in ( <, >, &, ...) 
{
  $input=~s/$xml/xmlescape{$xml}/g;
}

### "<" => "&lt;"

+       if ($input =~ m!(<script>)(.*)(</script>)!){
+               return undef;
+       }
        return $input;
 }