Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d8MPS-0004AO-9G for pgadmin-hackers@arkaria.postgresql.org; Wed, 10 May 2017 07:51:46 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84_2) (envelope-from ) id 1d8MPR-0001kb-Lu for pgadmin-hackers@arkaria.postgresql.org; Wed, 10 May 2017 07:51:45 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1d8AwI-0005fZ-Di for pgadmin-hackers@postgresql.org; Tue, 09 May 2017 19:36:54 +0000 Received: from imp-m.ru ([93.174.79.86]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1d8AwE-0004JJ-J5 for pgadmin-hackers@postgresql.org; Tue, 09 May 2017 19:36:53 +0000 Received: by imp-m.ru (Postfix, from userid 80) id D58CE73F489F; Tue, 9 May 2017 22:36:48 +0300 (MSK) To: pgadmin-hackers@postgresql.org Subject: security bug (with patch-fix) -- need more HTML-escaping for working with tree-nodes X-PHP-Originating-Script: 80:rcube.php MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=_d374e0ac66d00bd40f8ef20c9d65fb98" Date: Tue, 09 May 2017 22:36:48 +0300 From: Andrei Antonov Message-ID: X-Sender: antonov@imp-m.ru User-Agent: Roundcube Webmail/1.2.3 X-Pg-Spam-Score: -1.9 (-) List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgadmin-hackers Precedence: bulk Sender: pgadmin-hackers-owner@postgresql.org --=_d374e0ac66d00bd40f8ef20c9d65fb98 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8; format=flowed good day! i fixed tiny errors (html-escaping) , but it has security effects. see file "0001-escape-label-of-node-of-tree-when-events-add-remove-.patch" [ https://github.com/postgres-impulsm/pgadmin4/commit/f993513d148fc6dd7e0196261f847e668d5e2c6c ] -- Андрей Антонов, инженер-программист Отдела информационных технологий и программирования, компания «Импульс М» --=_d374e0ac66d00bd40f8ef20c9d65fb98 Content-Transfer-Encoding: base64 Content-Type: text/x-diff; name=0001-escape-label-of-node-of-tree-when-events-add-remove-.patch Content-Disposition: attachment; filename=0001-escape-label-of-node-of-tree-when-events-add-remove-.patch; size=1758 RnJvbSBmOTkzNTEzZDE0OGZjNmRkN2UwMTk2MjYxZjg0N2U2NjhkNWUyYzZj IE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBBbmRyZWkgQW50b25v diA8cG9seW1vcnBobUBnbWFpbC5jb20+CkRhdGU6IFR1ZSwgOSBNYXkgMjAx NyAyMjoxODo1NCArMDMwMApTdWJqZWN0OiBbUEFUQ0hdIGVzY2FwZSBsYWJl bCBvZiBub2RlIG9mIHRyZWUsIHdoZW4gZXZlbnRzOiBhZGRccmVtb3ZlXHVu bG9hZAoKLS0tCiB3ZWIvcGdhZG1pbi9icm93c2VyL3RlbXBsYXRlcy9icm93 c2VyL2pzL25vZGUuanMgfCA2ICsrKy0tLQogMSBmaWxlIGNoYW5nZWQsIDMg aW5zZXJ0aW9ucygrKSwgMyBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS93 ZWIvcGdhZG1pbi9icm93c2VyL3RlbXBsYXRlcy9icm93c2VyL2pzL25vZGUu anMgYi93ZWIvcGdhZG1pbi9icm93c2VyL3RlbXBsYXRlcy9icm93c2VyL2pz L25vZGUuanMKaW5kZXggZTMzN2ZlYzAuLmZmOGJjMDlmIDEwMDY0NAotLS0g YS93ZWIvcGdhZG1pbi9icm93c2VyL3RlbXBsYXRlcy9icm93c2VyL2pzL25v ZGUuanMKKysrIGIvd2ViL3BnYWRtaW4vYnJvd3Nlci90ZW1wbGF0ZXMvYnJv d3Nlci9qcy9ub2RlLmpzCkBAIC03NDMsNyArNzQzLDcgQEAgZnVuY3Rpb24o JCwgXywgUywgcGdBZG1pbiwgTWVudSwgQmFja2JvbmUsIEFsZXJ0aWZ5LCBw Z0Jyb3dzZXIsIEJhY2tmb3JtKSB7CiAgICAgICAgICAgdC5zZXRMYWJlbCgK ICAgICAgICAgICAgIHBJdGVtLCB7CiAgICAgICAgICAgICAgIGxhYmVsOiAo Ci0gICAgICAgICAgICAgICAgcERhdGEuX2xhYmVsICsgJyA8c3Bhbj4oJyAr IHBEYXRhLmNvbGxlY3Rpb25fY291bnQgKyAnKTwvc3Bhbj4nCisgICAgICAg ICAgICAgICAgXy5lc2NhcGUocERhdGEuX2xhYmVsKSArICcgPHNwYW4+KCcg KyBwRGF0YS5jb2xsZWN0aW9uX2NvdW50ICsgJyk8L3NwYW4+JwogICAgICAg ICAgICAgICApCiAgICAgICAgICAgICB9CiAgICAgICAgICAgKTsKQEAgLTgy MSw3ICs4MjEsNyBAQCBmdW5jdGlvbigkLCBfLCBTLCBwZ0FkbWluLCBNZW51 LCBCYWNrYm9uZSwgQWxlcnRpZnksIHBnQnJvd3NlciwgQmFja2Zvcm0pIHsK ICAgICAgICAgICB0LnNldExhYmVsKAogICAgICAgICAgICAgcEl0ZW0sIHsK ICAgICAgICAgICAgICAgbGFiZWw6ICgKLSAgICAgICAgICAgICAgICBwRGF0 YS5fbGFiZWwgKyAnIDxzcGFuPignICsgcERhdGEuY29sbGVjdGlvbl9jb3Vu dCArICcpPC9zcGFuPicKKyAgICAgICAgICAgICAgICBfLmVzY2FwZShwRGF0 YS5fbGFiZWwpICsgJyA8c3Bhbj4oJyArIHBEYXRhLmNvbGxlY3Rpb25fY291 bnQgKyAnKTwvc3Bhbj4nCiAgICAgICAgICAgICAgICkKICAgICAgICAgICAg IH0KICAgICAgICAgICApOwpAQCAtODM4LDcgKzgzOCw3IEBAIGZ1bmN0aW9u KCQsIF8sIFMsIHBnQWRtaW4sIE1lbnUsIEJhY2tib25lLCBBbGVydGlmeSwg cGdCcm93c2VyLCBCYWNrZm9ybSkgewogICAgICAgICBpZiAoc2VsZi5pc19j b2xsZWN0aW9uICYmICdjb2xsZWN0aW9uX2NvdW50JyBpbiBkYXRhKQogICAg ICAgICB7CiAgICAgICAgICAgZGVsZXRlIGRhdGEuY29sbGVjdGlvbl9jb3Vu dDsKLSAgICAgICAgICB0LnNldExhYmVsKGl0ZW0sIHtsYWJlbDogZGF0YS5f bGFiZWx9KTsKKyAgICAgICAgICB0LnNldExhYmVsKGl0ZW0sIHtsYWJlbDog Xy5lc2NhcGUoZGF0YS5fbGFiZWwpfSk7CiAgICAgICAgIH0KICAgICAgIH0s CiAgICAgICByZWZyZXNoOiBmdW5jdGlvbihjbWQsIGkpIHsKLS0gCjIuMTIu MgoK --=_d374e0ac66d00bd40f8ef20c9d65fb98 Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 -- Sent via pgadmin-hackers mailing list (pgadmin-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgadmin-hackers --=_d374e0ac66d00bd40f8ef20c9d65fb98--