Broken links for paths/committers with question marks

XMLWordPrintable

    • Type: Bug
    • Resolution: Fixed
    • Priority: Low
    • 3.6.2, 3.7.0
    • Affects Version/s: 2.10.0
    • Component/s: None
    • None

      For Fisheye indexed changesets committed by a committer with special characters in his/her name (e.g. </a><script>alert('f')</script> user <alerted2@example.com> ) the link to this committer's commits would not work, page would render error.

      It seems that the link is encoded properly, for the above example it is:
      ./committer/cs/%3C%2Fa%3E%3Cscript%3Ealert%28%27f%27%29%3C%2Fscript%3E%20user%20%3Calerted2%40example.com%3E
      but the page rendering it incorrectly decodes committer name as < and failing to find it renders error:

      The requested resource cannot be found.
      Committer < does not exist in repository cs

      This was identified by rstephens when reviewing FECRU-2624, see https://extranet.atlassian.com/crucible/cru/CR-FE-6991#c74313.

      In order to reproduce:

      1. commit a change as a committer with username of </a><script>alert('f')</script> user <alerted2@example.com>, ensure this gets indexed by FishEye
      2. navigate to activity page of the repository the change was checked into
      3. find the committer name in the activity pane and click on it. Although the URL is encoded properly, expect error message mentioned above

              Assignee:
              Lukasz Pater
              Reporter:
              Piotr Swiecicki
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: