Merge lp:~rharding/launchpad/xss_911632 into lp:launchpad

[Richard Harding]

[r=abentley][bug=911632] Fix template to escape output of no branch message.

= Summary =
A user discovered that there was a XSS script avenue in the code branch listing page for a user.

== Proposed Fix ==
The template was using a content:structure that prevented escaping of the html entities.

== Implementation Details ==
In searching, no one implementing the no_branch_message had any html in the constructed message. The structure was just removed to allow for escaping to take place at the template level.

== Tests ==
./bin/test -cvvt test_branchlisting

== Demo and Q/A ==
A user's full name needs to be changed to "'/><script>alert(true);</script>. Then you need to load up the user's code.launchpad.net page. Make sure there are no branches in the table view by changing the status filter until you trigger the "no branch message". The output should be escaped.

[Aaron Bentley (abentley)]

I'd prefer it if this used getViewBrowser, as it's simpler. But either way works.

review: Approve

[Richard Harding (rharding)]

Need to remove link from ProductBranchListingView and ProjectBranchesView alternate messages in order to prevent breaking those urls.

=== modified file 'lib/lp/code/browser/branchlisting.py'
--- lib/lp/code/browser/branchlisting.py	2012-01-01 02:58:52 +0000
+++ lib/lp/code/browser/branchlisting.py	2012-01-05 13:24:31 +0000
@@ -1240,7 +1240,7 @@
             message = (
                 'There are no branches registered for %s '
                 'in Launchpad today. We recommend you visit '
-                '<a href="http://www.bazaar-vcs.org">www.bazaar-vcs.org</a> '
+                'www.bazaar-vcs.org '
                 'for more information about how you can use the Bazaar '
                 'revision control system to improve community participation '
                 'in this project.')
@@ -1474,7 +1474,7 @@
             message = (
                 'There are no branches registered for %s '
                 'in Launchpad today. We recommend you visit '
-                '<a href="http://www.bazaar-vcs.org">www.bazaar-vcs.org</a> '
+                'www.bazaar-vcs.org '
                 'for more information about how you can use the Bazaar '
                 'revision control system to improve community participation '
                 'in this project group.')