You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@couchdb.apache.org by "Jan Lehnardt (JIRA)" <ji...@apache.org> on 2011/09/08 17:15:09 UTC
[jira] [Created] (COUCHDB-1275) Futon's recent database list
doesn't decode slashes in database names
Futon's recent database list doesn't decode slashes in database names
---------------------------------------------------------------------
Key: COUCHDB-1275
URL: https://issues.apache.org/jira/browse/COUCHDB-1275
Project: CouchDB
Issue Type: Bug
Components: Futon
Affects Versions: 1.1
Reporter: Jan Lehnardt
Priority: Minor
Create a database with a slash in it, futon will go to the database view automatically and add it to the recent databases list. the list will display the encoded %2f instead of the /
Here's a quick fix: http://friendpaste.com/1WORPAfSY5MUyoisaAQtZB
I tested it for XSS but I may have overlooked something and I'd appreciate a review.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (COUCHDB-1275) Futon's recent database list
doesn't decode slashes in database names
Posted by "Jan Lehnardt (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13213809#comment-13213809 ]
Jan Lehnardt commented on COUCHDB-1275:
---------------------------------------
Nope, from the browser sending that URL into Futon.
i.e. click on this: <a href="http://127.0.01:5984/_utils?<script>alert('hello'):</script>databasename">Free Stuff</a> and it'll show up in the recent db's list via a cookie.
> Futon's recent database list doesn't decode slashes in database names
> ---------------------------------------------------------------------
>
> Key: COUCHDB-1275
> URL: https://issues.apache.org/jira/browse/COUCHDB-1275
> Project: CouchDB
> Issue Type: Bug
> Components: Futon
> Affects Versions: 1.1
> Reporter: Jan Lehnardt
> Priority: Minor
>
> Create a database with a slash in it, futon will go to the database view automatically and add it to the recent databases list. the list will display the encoded %2f instead of the /
> Here's a quick fix: http://friendpaste.com/1WORPAfSY5MUyoisaAQtZB
> I tested it for XSS but I may have overlooked something and I'd appreciate a review.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (COUCHDB-1275) Futon's recent database list
doesn't decode slashes in database names
Posted by "Sam Bisbee (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13213814#comment-13213814 ]
Sam Bisbee commented on COUCHDB-1275:
-------------------------------------
Ah! Gotcha. :) Yeah, that crossed over into CSRF territory for me.
> Futon's recent database list doesn't decode slashes in database names
> ---------------------------------------------------------------------
>
> Key: COUCHDB-1275
> URL: https://issues.apache.org/jira/browse/COUCHDB-1275
> Project: CouchDB
> Issue Type: Bug
> Components: Futon
> Affects Versions: 1.1
> Reporter: Jan Lehnardt
> Priority: Minor
>
> Create a database with a slash in it, futon will go to the database view automatically and add it to the recent databases list. the list will display the encoded %2f instead of the /
> Here's a quick fix: http://friendpaste.com/1WORPAfSY5MUyoisaAQtZB
> I tested it for XSS but I may have overlooked something and I'd appreciate a review.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (COUCHDB-1275) Futon's recent database list
doesn't decode slashes in database names
Posted by "Sam Bisbee (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13213806#comment-13213806 ]
Sam Bisbee commented on COUCHDB-1275:
-------------------------------------
Right, but my point is how do those db names get in there? From futon's code querying the database for db names.
> Futon's recent database list doesn't decode slashes in database names
> ---------------------------------------------------------------------
>
> Key: COUCHDB-1275
> URL: https://issues.apache.org/jira/browse/COUCHDB-1275
> Project: CouchDB
> Issue Type: Bug
> Components: Futon
> Affects Versions: 1.1
> Reporter: Jan Lehnardt
> Priority: Minor
>
> Create a database with a slash in it, futon will go to the database view automatically and add it to the recent databases list. the list will display the encoded %2f instead of the /
> Here's a quick fix: http://friendpaste.com/1WORPAfSY5MUyoisaAQtZB
> I tested it for XSS but I may have overlooked something and I'd appreciate a review.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (COUCHDB-1275) Futon's recent database list
doesn't decode slashes in database names
Posted by "Jan Lehnardt (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13213810#comment-13213810 ]
Jan Lehnardt commented on COUCHDB-1275:
---------------------------------------
(thank you JIRA for making my point of escaping this being the solution :)
> Futon's recent database list doesn't decode slashes in database names
> ---------------------------------------------------------------------
>
> Key: COUCHDB-1275
> URL: https://issues.apache.org/jira/browse/COUCHDB-1275
> Project: CouchDB
> Issue Type: Bug
> Components: Futon
> Affects Versions: 1.1
> Reporter: Jan Lehnardt
> Priority: Minor
>
> Create a database with a slash in it, futon will go to the database view automatically and add it to the recent databases list. the list will display the encoded %2f instead of the /
> Here's a quick fix: http://friendpaste.com/1WORPAfSY5MUyoisaAQtZB
> I tested it for XSS but I may have overlooked something and I'd appreciate a review.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (COUCHDB-1275) Futon's recent database list
doesn't decode slashes in database names
Posted by "Sam Bisbee (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13217637#comment-13217637 ]
Sam Bisbee commented on COUCHDB-1275:
-------------------------------------
Since there is no danger of XSS and the CSRF issues aren't related to this ticket, +1 on merge?
> Futon's recent database list doesn't decode slashes in database names
> ---------------------------------------------------------------------
>
> Key: COUCHDB-1275
> URL: https://issues.apache.org/jira/browse/COUCHDB-1275
> Project: CouchDB
> Issue Type: Bug
> Components: Futon
> Affects Versions: 1.1
> Reporter: Jan Lehnardt
> Priority: Minor
>
> Create a database with a slash in it, futon will go to the database view automatically and add it to the recent databases list. the list will display the encoded %2f instead of the /
> Here's a quick fix: http://friendpaste.com/1WORPAfSY5MUyoisaAQtZB
> I tested it for XSS but I may have overlooked something and I'd appreciate a review.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (COUCHDB-1275) Futon's recent database list
doesn't decode slashes in database names
Posted by "Jan Lehnardt (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13218241#comment-13218241 ]
Jan Lehnardt commented on COUCHDB-1275:
---------------------------------------
yeah :)
> Futon's recent database list doesn't decode slashes in database names
> ---------------------------------------------------------------------
>
> Key: COUCHDB-1275
> URL: https://issues.apache.org/jira/browse/COUCHDB-1275
> Project: CouchDB
> Issue Type: Bug
> Components: Futon
> Affects Versions: 1.1
> Reporter: Jan Lehnardt
> Priority: Minor
>
> Create a database with a slash in it, futon will go to the database view automatically and add it to the recent databases list. the list will display the encoded %2f instead of the /
> Here's a quick fix: http://friendpaste.com/1WORPAfSY5MUyoisaAQtZB
> I tested it for XSS but I may have overlooked something and I'd appreciate a review.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (COUCHDB-1275) Futon's recent database list
doesn't decode slashes in database names
Posted by "Jan Lehnardt (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13213778#comment-13213778 ]
Jan Lehnardt commented on COUCHDB-1275:
---------------------------------------
db name restrictions don't help as Futon happily accepts bogus DB names and puts it in the recent-dbs list.
> Futon's recent database list doesn't decode slashes in database names
> ---------------------------------------------------------------------
>
> Key: COUCHDB-1275
> URL: https://issues.apache.org/jira/browse/COUCHDB-1275
> Project: CouchDB
> Issue Type: Bug
> Components: Futon
> Affects Versions: 1.1
> Reporter: Jan Lehnardt
> Priority: Minor
>
> Create a database with a slash in it, futon will go to the database view automatically and add it to the recent databases list. the list will display the encoded %2f instead of the /
> Here's a quick fix: http://friendpaste.com/1WORPAfSY5MUyoisaAQtZB
> I tested it for XSS but I may have overlooked something and I'd appreciate a review.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (COUCHDB-1275) Futon's recent database list
doesn't decode slashes in database names
Posted by "Sam Bisbee (Commented) (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/COUCHDB-1275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13212891#comment-13212891 ]
Sam Bisbee commented on COUCHDB-1275:
-------------------------------------
Looks good to me.
Also, we aren't open to a lot of the XSS attacks due to our db naming restrictions. That plus who you allow to create databases are the real safe guards.
> Futon's recent database list doesn't decode slashes in database names
> ---------------------------------------------------------------------
>
> Key: COUCHDB-1275
> URL: https://issues.apache.org/jira/browse/COUCHDB-1275
> Project: CouchDB
> Issue Type: Bug
> Components: Futon
> Affects Versions: 1.1
> Reporter: Jan Lehnardt
> Priority: Minor
>
> Create a database with a slash in it, futon will go to the database view automatically and add it to the recent databases list. the list will display the encoded %2f instead of the /
> Here's a quick fix: http://friendpaste.com/1WORPAfSY5MUyoisaAQtZB
> I tested it for XSS but I may have overlooked something and I'd appreciate a review.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira