OpenStack Dashboard (Horizon)

  1. Bug #1308727
  2. Comment #18

Comment 18 for bug 1308727

Revision history for this message
Julie Pichon (jpichon) wrote : Re: XSS in Horizon Heat template - resource name

As discussed with the vulnerability team, I'm attaching a single patch to fix the 3 XSS issues currently open against Horizon.

About the other clean-up tasks mentioned in this bug, I tried to exploit the potential vulnerability in _stack_info.html by adding things like this to the template:

outputs:
  WebsiteURL:
    description: A URL
    value: http://"><img src=zz onerror=alert(2)>

However the strings were escaped properly and I wasn't able to. I believe this is already safe thanks to django's auto-escaping (see https://docs.djangoproject.com/en/1.4/topics/templates/#automatic-html-escaping ).

I'd appreciate additional eyes from folks more familiar with Javascript on the network names fix, as I found the .text() behaviour fairly unintuitive. It parses HTML entities like &lt; into their text equivalent <, making safely escaped strings vulnerable again. I haven't had a chance to investigate other places where we use text(). I'll provide the Havana version of the patch shortly.