[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201106141514.25397.jnareb@gmail.com>
Date: Tue, 14 Jun 2011 15:14:24 +0200
From: Jakub Narebski <jnareb@...il.com>
To: Ludwig Nussel <ludwig.nussel@...e.de>
Cc: oss-security@...ts.openwall.com,
dave b <db.pub.mail@...il.com>,
Jamie Strandboge <jamie@...onical.com>,
Junio C Hamano <gitster@...ox.com>
Subject: Re: [CVE-2011-2186] XSS security issue in gitweb for 'blob_plain' view with HTML files
On Tue, 14 June 2011, Ludwig Nussel wrote:
> Jakub Narebski wrote:
> > [...] it is enough to enable XSS prevention by adding
> >
> > our $prevent_xss = 1;
> >
> > in gitweb configuration file.
>
> What about making that the default?
I'll come up with a patch... though I am not sure if it shouldn't be
done by distributions, which usually ship their own system-wide
gitweb config file.
Note that with $prevent_xss enabled gitweb is a bit poorer in features:
no support for $GIT_DIR/README.html, no using gitweb as deploy platform.
XSS threat level for gitweb isn't high, I think - there is nothing to
steal.
> For convenience it may make sense to s!text/.*!text/plain! and allow
> to display that inline.
Already done in
[PATCH] gitweb: Make $prevent_xss protection for 'blob_plain' more usable
http://article.gmane.org/gmane.comp.version-control.git/175604
http://thread.gmane.org/gmane.comp.version-control.git/175057/focus=175604
It is in git repository as
fb76adb (gitweb: Make $prevent_xss protection for 'blob_plain' more usable, 2011-06-10)
currently in 'pu' (proposed updates) patch.
--
Jakub Narebski
Poland
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
