Milestone etc. values for ticket query filters are not escaped

[joeray123@…]

Values that are placed into select boxes to filter queries are not escaped, meaning an XSS attack is possible.

How to reproduce

Create a milestone that has " characters in it, e.g:

'Hello "]}}; alert("test"); properties = {milestone: {options: ["'

Trac version: tested on 0.11.1 and 0.11.2.1

[osimons]

Thanks for the report. It seems we populate the various values into a JS inline script, and for some reason we enclose the option value in a set of "" quotes which basically nullifies the escape-by-default behavior.

This diff fixes the issue, and as far as I can see custom query continues to work as expected. Could someone else please confirm the fix, and is this serious enough to warrant a security release? It only affects meta-data, that very seldom can be modified by regular users. However, no doubt risks could exist depending on the setup of individual Trac sites.

trac/ticket/templates/query.html

@@ -192 +192 @@
         <py:for each="(field_name, field), sep in separated(fields.iteritems())">
           $field_name: { type: "$field.type", label: "$field.label"
           <py:if test="'options' in field">, options: [
-            <py:for each="option, sep in separated(field.options)">"$option"$sep
+            <py:for each="option, sep in separated(field.options)">$option$sep
             </py:for>]
           </py:if>}$sep
         </py:for>

[Jonas Borgström]

Fixed in [7786] and [7788] by introducing a new javascript_quote function in text.py.