CVE-2014-2236: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in Askbot before 0.7.49 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) tag or (2) user search forms.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-03-05T16:37Z
Repository: https://github.com/ASKBOT/askbot-devel
Language: Python
Files changed: askbot/templates/users.html, askbot/utils/functions.py, askbot/views/commands.py
Commit date: 2013-05-07 23:59:42 -0400
Commit message: fixed some xss issues

Diff: diff --git a/askbot/templates/users.html b/askbot/templates/users.html
index 5ab4c28a9..14e07f7f6 100644
--- a/askbot/templates/users.html
+++ b/askbot/templates/users.html
@@ -61,11 +61,11 @@
         </div>
     </div>
     <div class="clearfix"></div>
 </div>
 {% if search_query %}
-    <p>{% trans %}users matching query {{search_query}}:{% endtrans %}</p>
+    <p>{% trans search_query=search_query|escape %}users matching query {{search_query}}:{% endtrans %}</p>
 {% endif %}
 {% if not users.object_list %}
     <p><span>{% trans %}Nothing found.{% endtrans %}</span></p>
 {% endif %}
 {{ macros.user_list(
diff --git a/askbot/utils/functions.py b/askbot/utils/functions.py
index 592dcf431..ba9df877c 100644
--- a/askbot/utils/functions.py
+++ b/askbot/utils/functions.py
@@ -1,10 +1,11 @@
 import re
 import random
 import datetime
 from django.utils.translation import ugettext as _
 from django.utils.translation import ungettext
+from django.utils.html import escape
 
 def get_from_dict_or_object(source, key):
     try:
         return source[key]
     except:
@@ -156,11 +157,11 @@ def setup_paginator(context):
             next_page_number = page_object.next_page_number()
         else:
             next_page_number = None
 
         return {
-            "base_url": context["base_url"],
+            "base_url": escape(context["base_url"]),
             "is_paginated": context["is_paginated"],
             "previous": previous_page_number,
             "has_previous": page_object.has_previous(),
             "next": next_page_number,
             "has_next": page_object.has_next(),
diff --git a/askbot/views/commands.py b/askbot/views/commands.py
index 207a06153..dee8d1e49 100644
--- a/askbot/views/commands.py
+++ b/askbot/views/commands.py
@@ -697,11 +697,11 @@ def subscribe_for_tags(request):
                     message = _('Your tag subscription was saved, thanks!')
                 )
             else:
                 message = _(
                     'Tag subscription was canceled (<a href="%(url)s">undo</a>).'
-                ) % {'url': request.path + '?tags=' + request.REQUEST['tags']}
+                ) % {'url': escape(request.path) + '?tags=' + request.REQUEST['tags']}
                 request.user.message_set.create(message = message)
             return HttpResponseRedirect(reverse('index'))
         else:
             data = {'tags': tag_names}
             return render(request, 'subscribe_for_tags.html', data)

Vulnerable code:     <p>{% trans %}users matching query {{search_query}}:{% endtrans %}</p>
            "base_url": context["base_url"],
                ) % {'url': request.path + '?tags=' + request.REQUEST['tags']}
Fixed code:     <p>{% trans search_query=search_query|escape %}users matching query {{search_query}}:{% endtrans %}</p>
from django.utils.html import escape
            "base_url": escape(context["base_url"]),
                ) % {'url': escape(request.path) + '?tags=' + request.REQUEST['tags']}