0012368: Remove input side XSS validation of user real names

View Issue Details [ Jump to Notes ] [ Wiki ] [ Related Changesets ]

[ Issue History ] [ Print ]

Project

Category

View Status

Date Submitted

Last Update

0012368

mantisbt

bugtracker

public

2010-09-18 01:19

2013-04-06 09:26

Reporter

dhx

Assigned To

dhx

Priority

normal

Severity

feature

Reproducibility

N/A

Status

resolved

Resolution

fixed

Platform

OS Version

Product Version

1.3.x

Target Version

1.3.x

Fixed in Version

1.3.x

Summary

0012368: Remove input side XSS validation of user real names

Description

XSS issues should be handled on the output side of MantisBT rather than on the input side. The user real name field was being validated on the input side which is poor design due to the many number of ways in which a user real name could change (SOAP API, XML import, web interface, external scripts, plugins, etc). Furthermore different output interfaces (XML, CSS, XHTML, etc) require different sanitisation and escaping methods.

Thus we should remove the input side XSS validation of the user real name field so that we allow ANY characters to be used in this field (except 0x00 of course). Our existing output layers already handle XSS sanitisation of variables such as the real name field.

Tags

2.0.x check

Attached Files

Relationships

related to	0012441	resolved	daryn	Unable to update custom fields due to missing function error.
related to	0015721	new		Functionality to consider porting to master-2.0.x
related to	0008743	closed	dhx	function string_contains_scripting_chars should check for ' and "

Notes
(0036231) grangeway (developer) 2013-04-05 17:57	Marking as 'acknowledged' not resolved/closed to track that change gets ported to master-2.0.x branch

Related Changesets
MantisBT: master 01d2ffad Timestamp: 2010-09-18 05:19:30 Author: dhx [ Details ] [ Diff ]	Issue 0012368: Remove input side XSS validation of user real names XSS issues should be handled on the output side of MantisBT rather than on the input side. The user real name field was being validated on the input side which is poor design due to the many number of ways in which a user real name could change (SOAP API, XML import, web interface, external scripts, plugins, etc). Furthermore different output interfaces (XML, CSS, XHTML, etc) require different sanitisation and escaping methods. Thus we should remove the input side XSS validation of the user real name field so that we allow ANY characters to be used in this field (except 0x00 of course). Our existing output layers already handle XSS sanitisation of variables such as the real name field.
	mod - manage_user_create.php	[ Diff ] [ File ]
	mod - manage_user_update.php	[ Diff ] [ File ]
	mod - core/user_api.php	[ Diff ] [ File ]
	mod - core/custom_field_api.php	[ Diff ] [ File ]
	mod - account_update.php	[ Diff ] [ File ]
	mod - core/string_api.php	[ Diff ] [ File ]

Issue History
Date Modified	Username	Field	Change
2010-09-18 01:19	dhx	New Issue
2010-09-18 01:19	dhx	Status	new => assigned
2010-09-18 01:19	dhx	Assigned To	=> dhx
2010-09-18 01:22	dhx	Changeset attached	=> MantisBT master 01d2ffad
2010-09-18 01:22	dhx	Status	assigned => resolved
2010-09-18 01:22	dhx	Fixed in Version	=> 1.3.x
2010-09-18 01:22	dhx	Resolution	open => fixed
2010-09-18 01:22	dhx	Relationship added	related to 0008743
2012-10-03 08:42	dregad	Relationship added	related to 0012441
2013-04-05 17:57	grangeway	Status	resolved => acknowledged
2013-04-05 17:57	grangeway	Note Added: 0036231
2013-04-05 18:48	grangeway	Relationship added	related to 0015721
2013-04-06 03:44	dregad	Status	acknowledged => resolved
2013-04-06 07:20	grangeway	Status	resolved => acknowledged
2013-04-06 09:26	dregad	Tag Attached: 2.0.x check
2013-04-06 09:26	dregad	Status	acknowledged => resolved

MantisBT 1.2.16dev master-1.2.x-8c2bd07 [^]

Time: 0.1135 seconds.
memory usage: 2,821 KB