Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 14 Jun 2011 15:38:58 +0200
From: Ludwig Nussel <>
To: Jakub Narebski <>
Cc:, dave b <>,
	Jamie Strandboge <>,
	Junio C Hamano <>
Subject: Re: [CVE-2011-2186] XSS security issue in gitweb for 'blob_plain' view with HTML files

Jakub Narebski wrote:
> On Tue, 14 June 2011, Ludwig Nussel wrote:
> > Jakub Narebski wrote:
> > > [...] it is enough to enable XSS prevention by adding
> > > 
> > >   our $prevent_xss = 1;
> > > 
> > > in gitweb configuration file.
> > 
> > What about making that the default?
> I'll come up with a patch... though I am not sure if it shouldn't be
> done by distributions, which usually ship their own system-wide
> gitweb config file.

We don't have a system wide config at least. It's just the defaults
in the script.

> Note that with $prevent_xss enabled gitweb is a bit poorer in features:
> no support for $GIT_DIR/README.html, no using gitweb as deploy platform.
> XSS threat level for gitweb isn't high, I think - there is nothing to
> steal.

You never know. Better safe than sorry :-)

> > For convenience it may make sense to s!text/.*!text/plain! and allow
> > to display that inline.
> Already done in
>   [PATCH] gitweb: Make $prevent_xss protection for 'blob_plain' more usable
> It is in git repository as
>   fb76adb (gitweb: Make $prevent_xss protection for 'blob_plain' more usable, 2011-06-10)
> currently in 'pu' (proposed updates) patch.

Ah, nice :-)


 (o_   Ludwig Nussel
SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imend├Ârffer, HRB 16746 (AG N├╝rnberg) 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.