Обсуждение: [pgadmin-hackers] security bug (with patch-fix) -- need more HTML-escaping for working with tree-nodes

good day!

i fixed tiny errors (html-escaping) , but it has security effects.

see file "0001-escape-label-of-node-of-tree-when-events-add-remove-.patch" [ https://github.com/postgres-impulsm/pgadmin4/commit/f993513d148fc6dd7e0196261f847e668d5e2c6c ]




--
Андрей Антонов,
инженер-программист Отдела информационных технологий и программирования,
компания «Импульс М»

--
Sent via pgadmin-hackers mailing list (pgadmin-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgadmin-hackers

On Wed, May 10, 2017 at 9:00 AM, Ashesh Vashi <ashesh.vashi@enterprisedb.com> wrote:

On Wed, May 10, 2017 at 1:29 PM, Dave Page <dpage@pgadmin.org> wrote:

On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi <ashesh.vashi@enterprisedb.com> wrote:

Thanks.

Committed!

I agree with the change from a preventative/safety perspective, though I'm struggling to classify it as a security issue, given that collections are always named by the code and not from user input. 

Am I missing something?

True - but not the case with the server-group.

It is a collection node, still has it's own label.

Ahh, yes. 

--

Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

BTW; Ashesh, can you please ensure there's an RM ticket for this, as it's obviously of interest to users.

Thanks.

On Wed, May 10, 2017 at 9:06 AM, Dave Page <dpage@pgadmin.org> wrote:

On Wed, May 10, 2017 at 9:00 AM, Ashesh Vashi <ashesh.vashi@enterprisedb.com> wrote:

On Wed, May 10, 2017 at 1:29 PM, Dave Page <dpage@pgadmin.org> wrote:

On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi <ashesh.vashi@enterprisedb.com> wrote:

Thanks.

Committed!

I agree with the change from a preventative/safety perspective, though I'm struggling to classify it as a security issue, given that collections are always named by the code and not from user input. 

Am I missing something?

True - but not the case with the server-group.

It is a collection node, still has it's own label.

Ahh, yes. 

--

Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

--

Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company