MIME-Version: 1.0
In-Reply-To: <b6c79719012594bfe674b809337298b1@imp-m.ru>
References: <b6c79719012594bfe674b809337298b1@imp-m.ru>
From: Ashesh Vashi <ashesh.vashi@enterprisedb.com>
Date: Wed, 10 May 2017 13:26:51 +0530
Message-ID: 
 <CAG7mmoygGeXaeV9WT3cBtLKf_4qsdFBvivUZyp1pbkxmh3mUkw@mail.gmail.com>
Subject: Re: security bug (with patch-fix) -- need more
 HTML-escaping for working with tree-nodes
To: Andrei Antonov <antonov@imp-m.ru>
Cc: pgadmin-hackers <pgadmin-hackers@postgresql.org>
Content-Type: multipart/alternative; boundary=001a11444bd4e02a0f054f26d1e4
Precedence: bulk
Sender: pgadmin-hackers-owner@postgresql.org

--001a11444bd4e02a0f054f26d1e4
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: base64

VGhhbmtzLg0KQ29tbWl0dGVkIQ0KDQotLQ0KDQpUaGFua3MgJiBSZWdhcmRzLA0KDQpBc2hlc2gg
VmFzaGkNCkVudGVycHJpc2VEQiBJTkRJQTogRW50ZXJwcmlzZSBQb3N0Z3JlU1FMIENvbXBhbnkN
CjxodHRwOi8vd3d3LmVudGVycHJpc2VkYi5jb20+DQoNCg0KKmh0dHA6Ly93d3cubGlua2VkaW4u
Y29tL2luL2FzaGVzaHZhc2hpKg0KPGh0dHA6Ly93d3cubGlua2VkaW4uY29tL2luL2FzaGVzaHZh
c2hpPg0KDQoyMDE3LTA1LTEwIDE6MDYgR01UKzA1OjMwIEFuZHJlaSBBbnRvbm92IDxhbnRvbm92
QGltcC1tLnJ1PjoNCg0KPiBnb29kIGRheSENCj4NCj4gaSBmaXhlZCB0aW55IGVycm9ycyAoaHRt
bC1lc2NhcGluZykgLCBidXQgaXQgaGFzIHNlY3VyaXR5IGVmZmVjdHMuDQo+DQo+IHNlZSBmaWxl
ICIwMDAxLWVzY2FwZS1sYWJlbC1vZi1ub2RlLW9mLXRyZWUtd2hlbi1ldmVudHMtYWRkLXJlbW92
ZS0ucGF0Y2giDQo+IFsgaHR0cHM6Ly9naXRodWIuY29tL3Bvc3RncmVzLWltcHVsc20vcGdhZG1p
bjQvY29tbWl0L2Y5OTM1MTNkDQo+IDE0OGZjNmRkN2UwMTk2MjYxZjg0N2U2NjhkNWUyYzZjIF0N
Cj4NCj4NCj4NCj4NCj4gLS0NCj4g0JDQvdC00YDQtdC5INCQ0L3RgtC+0L3QvtCyLA0KPiDQuNC9
0LbQtdC90LXRgC3Qv9GA0L7Qs9GA0LDQvNC80LjRgdGCINCe0YLQtNC10LvQsCDQuNC90YTQvtGA
0LzQsNGG0LjQvtC90L3Ri9GFINGC0LXRhdC90L7Qu9C+0LPQuNC5INC4INC/0YDQvtCz0YDQsNC8
0LzQuNGA0L7QstCw0L3QuNGPLA0KPiDQutC+0LzQv9Cw0L3QuNGPIMKr0JjQvNC/0YPQu9GM0YEg
0JzCuw0KPg0KPiAtLQ0KPiBTZW50IHZpYSBwZ2FkbWluLWhhY2tlcnMgbWFpbGluZyBsaXN0IChw
Z2FkbWluLWhhY2tlcnNAcG9zdGdyZXNxbC5vcmcpDQo+IFRvIG1ha2UgY2hhbmdlcyB0byB5b3Vy
IHN1YnNjcmlwdGlvbjoNCj4gaHR0cDovL3d3dy5wb3N0Z3Jlc3FsLm9yZy9tYWlscHJlZi9wZ2Fk
bWluLWhhY2tlcnMNCj4NCj4NCg==
--001a11444bd4e02a0f054f26d1e4
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Thanks.<div>Committed!</div></div><div class=3D"gmail_extr=
a"><br clear=3D"all"><div><div class=3D"gmail_signature" data-smartmail=3D"=
gmail_signature"><div dir=3D"ltr"><div style=3D"margin:0pt 0pt 8px"><p styl=
e=3D"margin:0pt"><span style=3D"font-family:courier new,monospace"><span st=
yle=3D"font-style:italic"><span>--</span></span></span></p><p style=3D"marg=
in:0pt"><span style=3D"font-family:courier new,monospace"><span style=3D"fo=
nt-style:italic"><span>Thanks &amp; Regards,</span></span><br style=3D"font=
-style:italic"><br style=3D"font-style:italic"><span style=3D"font-style:it=
alic">Ashesh Vashi</span><br style=3D"font-style:italic"><span style=3D"fon=
t-style:italic">EnterpriseDB INDIA: </span><a href=3D"http://www.enterprise=
db.com" target=3D"_blank">Enterprise PostgreSQL Company</a></span></p>
<p style=3D"margin:0pt"><span style=3D"font-family:courier new,monospace"><=
br></span></p>
<p style=3D"margin:0pt"><span style=3D"font-family:courier new,monospace"><=
a href=3D"http://www.linkedin.com/in/asheshvashi" target=3D"_blank"><i>http=
://www.linkedin.com/in/asheshvashi</i></a><img src=3D"http://s.wisestamp.co=
m/pixel.png?p=3Dmozilla&amp;v=3D2.0.3&amp;t=3D1285751372076&amp;u=3D4060523=
&amp;e=3D777" height=3D"1" width=3D"1"></span></p></div></div></div></div>
<br><div class=3D"gmail_quote">2017-05-10 1:06 GMT+05:30 Andrei Antonov <sp=
an dir=3D"ltr">&lt;<a href=3D"mailto:antonov@imp-m.ru" target=3D"_blank">an=
tonov@imp-m.ru</a>&gt;</span>:<br><blockquote class=3D"gmail_quote" style=
=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">good day=
!<br>
<br>
i fixed tiny errors (html-escaping) , but it has security effects.<br>
<br>
see file &quot;0001-escape-label-of-node-of-<wbr>tree-when-events-add-remov=
e-.p<wbr>atch&quot; [ <a href=3D"https://github.com/postgres-impulsm/pgadmi=
n4/commit/f993513d148fc6dd7e0196261f847e668d5e2c6c" rel=3D"noreferrer" targ=
et=3D"_blank">https://github.com/postgres-im<wbr>pulsm/pgadmin4/commit/f993=
513d<wbr>148fc6dd7e0196261f847e668d5e2c<wbr>6c</a> ]<span class=3D"HOEnZb">=
<font color=3D"#888888"><br>
<br>
<br>
<br>
<br>
-- <br>
=D0=90=D0=BD=D0=B4=D1=80=D0=B5=D0=B9 =D0=90=D0=BD=D1=82=D0=BE=D0=BD=D0=BE=
=D0=B2,<br>
=D0=B8=D0=BD=D0=B6=D0=B5=D0=BD=D0=B5=D1=80-=D0=BF=D1=80=D0=BE=D0=B3=D1=80=
=D0=B0=D0=BC=D0=BC=D0=B8=D1=81=D1=82 =D0=9E=D1=82=D0=B4=D0=B5=D0=BB=D0=B0 =
=D0=B8=D0=BD=D1=84=D0=BE=D1=80=D0=BC=D0=B0=D1=86=D0=B8=D0=BE=D0=BD=D0=BD=D1=
=8B=D1=85 =D1=82=D0=B5=D1=85=D0=BD=D0=BE=D0=BB=D0=BE=D0=B3=D0=B8=D0=B9 =D0=
=B8 =D0=BF=D1=80=D0=BE=D0=B3=D1=80=D0=B0=D0=BC=D0=BC=D0=B8=D1=80=D0=BE=D0=
=B2=D0=B0=D0=BD=D0=B8=D1=8F,<br>
=D0=BA=D0=BE=D0=BC=D0=BF=D0=B0=D0=BD=D0=B8=D1=8F =C2=AB=D0=98=D0=BC=D0=BF=
=D1=83=D0=BB=D1=8C=D1=81 =D0=9C=C2=BB</font></span><br><br>
--<br>
Sent via pgadmin-hackers mailing list (<a href=3D"mailto:pgadmin-hackers@po=
stgresql.org">pgadmin-hackers@postgresql.<wbr>org</a>)<br>
To make changes to your subscription:<br>
<a href=3D"http://www.postgresql.org/mailpref/pgadmin-hackers" rel=3D"noref=
errer" target=3D"_blank">http://www.postgresql.org/<wbr>mailpref/pgadmin-ha=
ckers</a><br>
<br></blockquote></div><br></div>

--001a11444bd4e02a0f054f26d1e4--