HTML のエスケープ漏れ対応

• Informador: miau
• Propietario: tmatsuzawa
• Tipo: Patches
• Estado: Open [Owner assigned]
• Componente: エレコマ本体
• Hito: (Ninguno)
• Prioridad: 5 - Medium
• Gravedad: 5 - Medium
• Resolución: Accepted
• Fichero: Ninguno

Details Responder

何か所か HTML のエスケープ漏れがあり、XSS が可能になっているようです。

validation がかかっていないユーザ入力値について、エスケープされていない箇所を修正しました。 （tel01 は validation されているのでエスケープは不要ですが、tel02 等がエスケープされているので周りにあわせてエスケープ処理を追加しています。）

 diff --git a/app/views/accounts/delivery_list.html.erb b/app/views/accounts/delivery_list.html.erb
 index e004d78..c595939 100644
 --- a/app/views/accounts/delivery_list.html.erb
 +++ b/app/views/accounts/delivery_list.html.erb
 @@ -28,8 +28,8 @@
                <td>お届け先住所</td>
                <td>
                  〒<%= address.zipcode01 %>-<%= address.zipcode02 %><br />
 -                <%= address.prefecture.name %><%= address.address_city %><br /><%= address.address_detail %><br />
 -                <%= address.family_name %> <%= address.first_name %>
 +                <%=h address.prefecture.name %><%=h address.address_city %><br /><%=h address.address_detail %><br />
 +                <%=h address.family_name %> <%=h address.first_name %>
                </td>
                <td class="buttom">
                  <%= link_to '変更', :action => :delivery_edit, :id => address.id %>
 diff --git a/app/views/accounts/delivery_list_mobile.html.erb b/app/views/accounts/delivery_list_mobile.html.erb
 index 817af82..13b143d 100644
 --- a/app/views/accounts/delivery_list_mobile.html.erb
 +++ b/app/views/accounts/delivery_list_mobile.html.erb
 @@ -16,8 +16,8 @@
  <%= i+1 %><br />
  お届け先住所<br />
        〒<%= address.zipcode01 %>-<%= address.zipcode02 %><br />
 -      <%= address.prefecture.name %><%= address.address_city %><br /><%= address.address_detail %><br />
 -      <%= address.family_name %> <%= address.first_name %><br />
 +      <%=h address.prefecture.name %><%=h address.address_city %><br /><%=h address.address_detail %><br />
 +      <%=h address.family_name %> <%=h address.first_name %><br />
  <br />
  <div style="text-align:center;">
        <%= link_to '変更', :action => :delivery_edit, :id => address.id %>
 diff --git a/app/views/admin/customers/search.html.erb b/app/views/admin/customers/search.html.erb
 index 41470ad..53400c1 100644
 --- a/app/views/admin/customers/search.html.erb
 +++ b/app/views/admin/customers/search.html.erb
 @@ -46,8 +46,8 @@
        <td rowspan="2"><%= Customer::ACTIVATE_NAMES[c.activate.to_i] %></td>
        <td><%= c.id %></td>
        <td rowspan="2">
 -        <%= c.full_name %>／
 -        <%= c.full_name_kana %>
 +        <%=h c.full_name %>／
 +        <%=h c.full_name_kana %>
        </td>
        <td rowspan="2"><%= System::SEX_NAMES[c.sex] %></td>
        <td><%= c.tel_no %></td>
 diff --git a/app/views/questionnaires/confirm.html.erb b/app/views/questionnaires/confirm.html.erb
 index 420164d..35100f2 100644
 --- a/app/views/questionnaires/confirm.html.erb
 +++ b/app/views/questionnaires/confirm.html.erb
 @@ -97,7 +97,7 @@
        </tr>
        <tr>
          <th>※お電話番号</th>
 -        <td><%= @respondent.tel01 %> - <%=h @respondent.tel02 %> - <%=h @respondent.tel03 %></td>
 +        <td><%=h @respondent.tel01 %> - <%=h @respondent.tel02 %> - <%=h @respondent.tel03 %></td>
        </tr>
        <tr>
          <th>※メールアドレス</th>
 diff --git a/app/views/questionnaires/confirm_mobile.html.erb b/app/views/questionnaires/confirm_mobile.html.erb
 index adef0e1..3e67e3d 100644
 --- a/app/views/questionnaires/confirm_mobile.html.erb
 +++ b/app/views/questionnaires/confirm_mobile.html.erb
 @@ -65,7 +65,7 @@
    <%=h @respondent.prefecture_name %><%=h @respondent.address_city %><br />
    <%=h @respondent.address_details %><br /><br />
    ※お電話番号<br />
 -  <%= @respondent.tel01 %> - <%=h @respondent.tel02 %> - <%=h @respondent.tel03 %><br /><br />
 +  <%=h @respondent.tel01 %> - <%=h @respondent.tel02 %> - <%=h @respondent.tel03 %><br /><br />
    ※メールアドレス<br />
    <%=h @respondent.email %><br /><br />
  

Ticket History (2/2 Histories)

2010-05-21 08:59 Updated by: miau

• New Ticket "HTML のエスケープ漏れ対応" created

2010-08-05 16:54 Updated by: tmatsuzawa

• Componente Update from (Ninguno) to エレコマ本体
• Resolución Update from Ninguno to Accepted
• Propietario Update from (Ninguno) to tmatsuzawa