[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #23574 [Internal Services/Tor Sysadmin Team]: Don't allow text injection in our 404 page

#23574: Don't allow text injection in our 404 page
-------------------------------------------------+-------------------------
 Reporter:  gk                                   |          Owner:  tpa
     Type:  defect                               |         Status:  closed
 Priority:  Medium                               |      Milestone:
Component:  Internal Services/Tor Sysadmin Team  |        Version:
 Severity:  Normal                               |     Resolution:  invalid
 Keywords:                                       |  Actual Points:
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by hiro):

 I think the importat point is that no code can be executed.

 You can test by passing javascript to the url and it doesn't do anything.
 Although, if we really care we can have the message in the 404 page just
 to say "The URL you typed was not found" or something along those lines,
 without having to repeat the URL.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/23574#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs