Edgewall Software

Changes between Initial Version and Version 3 of Ticket #10114


Ignore:
Timestamp:
Apr 22, 2011, 11:25:33 PM (13 years ago)
Author:
Remy Blank
Comment:

Verified with IE8, and fixed in [10680].

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #10114

    • Property Status new → closed
    • Property Component general → wiki system
    • Property Owner set to Remy Blank
    • Property Milestone → 0.12.3
    • Property Keywords xss ie security added
    • Property Resolution → fixed

  • Ticket #10114 – Description

    initial v3  
     1The html macro does not sanitize  behaviour:url in style attributes...
     2so the following
    13{{{
    2 The html macro does not sanitize  behaviour:url in style attributes...
    3 so the following
    44<div style="behavior:url(test.txt)">
    5 could be used to potentially xss a user using IE[0].
     5}}}
     6could be used to potentially xss a user using IE.
    67
    78The content of text.txt could be something like this:
    8 "<SCRIPTLET> <IMPLEMENTS Type="Behavior"></IMPLEMENTS> <SCRIPT Language="javascript">alert(1)</SCRIPT> </SCRIPTLET>" -- Source [0]
    9 
    10 
    11 
    12 [0]
    13 http://heideri.ch/jso/#52
     9{{{
     10<SCRIPTLET>
     11<IMPLEMENTS Type="Behavior"></IMPLEMENTS>
     12<SCRIPT Language="javascript">alert(1)</SCRIPT>
     13</SCRIPTLET>
    1414}}}
     15Source: http://heideri.ch/jso/#52

  • Ticket #10114 – Release Notes

    initial v3  
     1Fixed a XSS vulnerability on IE.