Date: Tue, 14 Jun 2011 15:14:24 +0200 From: Jakub Narebski <jnareb@...il.com> To: Ludwig Nussel <ludwig.nussel@...e.de> Cc: oss-security@...ts.openwall.com, dave b <db.pub.mail@...il.com>, Jamie Strandboge <jamie@...onical.com>, Junio C Hamano <gitster@...ox.com> Subject: Re: [CVE-2011-2186] XSS security issue in gitweb for 'blob_plain' view with HTML files On Tue, 14 June 2011, Ludwig Nussel wrote: > Jakub Narebski wrote: > > [...] it is enough to enable XSS prevention by adding > > > > our $prevent_xss = 1; > > > > in gitweb configuration file. > > What about making that the default? I'll come up with a patch... though I am not sure if it shouldn't be done by distributions, which usually ship their own system-wide gitweb config file. Note that with $prevent_xss enabled gitweb is a bit poorer in features: no support for $GIT_DIR/README.html, no using gitweb as deploy platform. XSS threat level for gitweb isn't high, I think - there is nothing to steal. > For convenience it may make sense to s!text/.*!text/plain! and allow > to display that inline. Already done in [PATCH] gitweb: Make $prevent_xss protection for 'blob_plain' more usable http://article.gmane.org/gmane.comp.version-control.git/175604 http://thread.gmane.org/gmane.comp.version-control.git/175057/focus=175604 It is in git repository as fb76adb (gitweb: Make $prevent_xss protection for 'blob_plain' more usable, 2011-06-10) currently in 'pu' (proposed updates) patch. -- Jakub Narebski Poland
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.