diff options
| author | Byron Jones <glob@mozilla.com> | 2011-12-28 23:10:39 +0100 |
|---|---|---|
| committer | Dave Lawrence <dlawrence@mozilla.com> | 2011-12-28 23:10:39 +0100 |
| commit | f8813fc6a94b4e8e6d5e77009458ed8cb5a856c7 (patch) | |
| tree | 296e87acc2821814a20e53e91466621de93a1b99 | |
| parent | c60154086000258e8a9269d896aa8b9d41cb711c (diff) | |
| download | bugzilla-f8813fc6a94b4e8e6d5e77009458ed8cb5a856c7.tar.gz bugzilla-f8813fc6a94b4e8e6d5e77009458ed8cb5a856c7.tar.xz | |
Bug 697699 - (CVE-2011-3657) [SECURITY] XSS when viewing new charts or tabular and graphical reports in debug mode
r=gerv, a=LpSolit
| -rw-r--r-- | Bugzilla/Chart.pm | 2 | ||||
| -rwxr-xr-x | report.cgi | 4 |
2 files changed, 3 insertions, 3 deletions
diff --git a/Bugzilla/Chart.pm b/Bugzilla/Chart.pm index 5022723dd..86dcf9d03 100644 --- a/Bugzilla/Chart.pm +++ b/Bugzilla/Chart.pm @@ -438,7 +438,7 @@ sub dump { require Data::Dumper; say "<pre>Bugzilla::Chart object:"; - print Data::Dumper::Dumper($self); + print html_quote(Data::Dumper::Dumper($self)); print "</pre>"; } diff --git a/report.cgi b/report.cgi index 20e899a6b..209ef0faf 100755 --- a/report.cgi +++ b/report.cgi @@ -288,9 +288,9 @@ print $cgi->header(-type => $format->{'ctype'}, if ($cgi->param('debug')) { require Data::Dumper; say "<pre>data hash:"; - say Data::Dumper::Dumper(%data); + say html_quote(Data::Dumper::Dumper(%data)); say "\ndata array:"; - say Data::Dumper::Dumper(@image_data) . "\n\n</pre>"; + say html_quote(Data::Dumper::Dumper(@image_data)) . "\n\n</pre>"; } # All formats point to the same section of the documentation. |