Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

XSS vulnerability in src/doc/not_found.md #24872

Closed
XMPPwocky opened this issue Apr 27, 2015 · 0 comments · Fixed by #24881
Closed

XSS vulnerability in src/doc/not_found.md #24872

XMPPwocky opened this issue Apr 27, 2015 · 0 comments · Fixed by #24881
Labels
T-rustdoc Relevant to the rustdoc team, which will review and decide on the PR/issue.

Comments

@XMPPwocky
Copy link
Contributor

Example: (copy into browser; Github URL-encodes URLs, which breaks this)
http://doc.rust-lang.org/std/trait.Any.html#method.hullo"><img src="nope" onerror="alert('hi');">

Method name should be sanitized properly.
@steveklabnik steveklabnik added I-wrong T-rustdoc Relevant to the rustdoc team, which will review and decide on the PR/issue. labels Apr 27, 2015
chris-morgan added a commit to chris-morgan/rust that referenced this issue Apr 28, 2015
@chris-morgan
Fix rust-lang#24872, XSS in docs not found page.
928bd4f
@chris-morgan chris-morgan mentioned this issue Apr 28, 2015
Merged
bors added a commit that referenced this issue Apr 28, 2015
@bors
Auto merge of #24881 - chris-morgan:issue-24872, r=alexcrichton
364639e 
Fixes #24872.
alexcrichton added a commit to alexcrichton/rust that referenced this issue Apr 29, 2015
@alexcrichton
rollup merge of rust-lang#24881: chris-morgan/issue-24872
8daf961 
Fixes rust-lang#24872.
steveklabnik pushed a commit to steveklabnik/rust that referenced this issue May 10, 2015
@chris-morgan @steveklabnik
Fix rust-lang#24872, XSS in docs not found page.
720f586
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
T-rustdoc Relevant to the rustdoc team, which will review and decide on the PR/issue.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix #24872, XSS in docs not found page. chris-morgan/rust
2 participants
@steveklabnik @XMPPwocky