yahoo-eng-team team mailing list archive

Thread
Date

[Bug 1260525] Re: Incomplete XSS fix for ossa/1247675

To: yahoo-eng-team@xxxxxxxxxxxxxxxxxxx
From: Thierry Carrez <thierry.carrez+lp@xxxxxxxxx>
Date: Tue, 14 Apr 2015 16:43:40 -0000
Reply-to: Bug 1260525 <1260525@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

** Changed in: horizon
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Dashboard (Horizon).
https://bugs.launchpad.net/bugs/1260525

Title:
  Incomplete XSS fix for ossa/1247675

Status in OpenStack Dashboard (Horizon):
  Fix Released
Status in OpenStack Security Advisories:
  Invalid

Bug description:
  The patch for https://bugs.launchpad.net/ossa/+bug/1247675 did not
  completely fix the reported issue.

  It failed to completely remove the use of html.strip_tags, which is
  not intended to be a security function, and does not properly sanitize
  output.

  https://github.com/openstack/horizon/blob/master/openstack_dashboard/dashboards/project/volumes/tables.py#L254

To manage notifications about this bug go to:
https://bugs.launchpad.net/horizon/+bug/1260525/+subscriptions