[Zope-Coders] Re: [Zope-Checkins] CVS: Zope/lib/python/AccessControl - PermissionMapping.py:1.12 Role.py:1.54

[Martijn Pieters]

On Thu, Aug 01, 2002 at 04:07:01PM +0000, Florent Guillaume wrote:
> Martijn Pieters  <mj@zope.com> wrote:
> > -        raise AttributeError, name
> > +        raise AttributeError, escape(name)
> 
> I don't understand why the escaping is done at that place. Surely, it
> should be the role of the stuff that displays the error to do the
> escaping.

The current error handling mechanism expects some error messages to contain
HTML; the form a complete message to be displayed. in
standard_error_message, this is found in the variable error_message. Because
of this, any HTML found in error_type will cause it to be copied to
error_message as well.

As I could not change this mechanism, all that was left was avoiding
*outside* untrusted HTML to end up being rendered.

> The only problems I see are stuff like:
> >          raise 'Invalid Permission', (
> > -            "The permission <em>%s</em> is invalid." % permission)
> > +            "The permission <em>%s</em> is invalid." % escape(permission))
> 
> where I don't think we should put HTML at all in the raised message.

Exactly. That is why I escape the data. You can construct certain URLs to
a management screen with the 'permission' parameter in it, where that
paramater contains arbitrary HTML. It is, of course, not a valid permission
name, the exception gets raised, and is sent back to the browser.

In the browser, the HTML is rendered as trusted, as it comes from the
server. This means any Javascript in the HTML can now steal cookies and
such. All I have to do now is trick you into opening a URL, from, say an
HTML email message.

-- 
Martijn Pieters
| Software Engineer  mailto:mj@zope.com
| Zope Corporation   http://www.zope.com/
| Creators of Zope   http://www.zope.org/
---------------------------------------------