ministryofjustice/tribunals_base — pull request #67 by Najaf (2014-11-27 14:34:52+00:00)
Title: Fixes reflected XSS vuln on search results page

Hi again,

@himal-mandalia @fordie @tatyree

I think I've found a reflected XSS vulnerability on the search results page. It seems as though you can plug arbitrary html into the query parameter and have the page display it unescaped to the user. Builtin XSS protection in latest Chrome/Safari appears to catch it, but firefox and older browsers are vulnerable.

Try clicking this link in Firefox to see a demonstration:

[Javascript Injected Link](http://localhost:5000/tribunals/utiac/decisions?utf8=%E2%9C%93&tab=reported&view=table&sort_by=promulgated_on+DESC&lastx=&date_from=&date_to=&judge_ids=&country_ids=&query=%3Cscript%3Ealert(%27BOOM!%27)%3C%2Fscript%3E&search_type=All)

The change in this PR appears to mitigate it without breaking any tests. No need to merge it exactly as it is, but however you fix this vuln I'd just double check to make sure the above POC no longer works.

Let me know if you have any questions about any of the above.