I've observed this problem when changing the title of the following issue:
http://drupal.org/node/57918

and I'll try to do some tests now here.

Comments

markus_petrux’s picture

markus_petrux commented
Title: XSS found when changing <em>title</em> » XSS found when changing <em>title</em> ?

Changing the title here

markus_petrux’s picture

markus_petrux commented

ok, please note the "issue changes line" on the above comment. The tags have not been cleaned!

killes@www.drop.org’s picture

killes@www.drop.org commented

Can you add actual XSS? em isn't particularly dangerous.

markus_petrux’s picture

markus_petrux commented
Title: XSS found when changing <em>title</em> ? » XSS found when changing <em onmouseover="alert('XSS')">title</em> ?

testing script

markus_petrux’s picture

markus_petrux commented
Title: XSS found when changing <em onmouseover="alert('XSS')">title</em> ? » XSS found when changing <em>title</em> ?

So there is some kind of filtering? Anyway, it doesn't match the filter applied to the issue title.

Zen’s picture

Zen commented
Project: Drupal.org site moderators » Project
Component: other » Projects
Priority: Critical » Normal
dww’s picture

dww
we/he/they
commented
Assigned: Unassigned » dww
Priority: Normal » Critical
Status: Active » Fixed

i already found and fixed these bugs on april 22nd. the version of project.module running on drupal.org was updated on that day. in fact, i've got a draft of the security announcement about this already written and submitted to security@drupal.org.

by the way, that is the correct place to send reports of possible security problems, not directly to the public issue queue. that way, the security team has a chance to verify, fix, and prepare a release that closes the hole, before the exploit is publically known. i'm just waiting the approval of the announcement (which was lower priority than getting 4.7.0 out, it seems) and the whole world will know about this bug and the fact that it's already been fixed.

thanks,
-derek

markus_petrux’s picture

markus_petrux commented

True, mea culpa

But these things happen:
http://drupal.org/node/19845 (opened April, 2 2005, session fixation 1 year later)

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)