AntarcticleIcon indicating the project type

Antarcticle

Uploaded image for project: 'Antarcticle'
  1. Antarcticle
  2. ANTARCTICLE-252

Tags Filter: insufficient filtering of special characters

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.0
    • Fix Version/s: 2.0
    • Labels:
      None

      Description

      Steps to reproduce:
      1. Open Antarcticle main page
      2. Enter in Tags Filter field: <script>alert('test')</script> and press Find button

      AR: pop-up window appears with "Oops, an error occured" error text, see screenshot
      ER: no pop-up window is shown

        Attachments

        Structure

        (does not include ANTARCTICLE-252)
        Open
        History

          Activity

          Ascending order - Click to sort in descending order
          Hide
          Permalink
          jk1 Evgeniy Naumenko added a comment -

          This bug has nothing to do with XSS. The real cause is inadequate search tag handling on DAO layer; current implementation fails on special symbols like '.

          Show
          jk1 Evgeniy Naumenko added a comment - This bug has nothing to do with XSS. The real cause is inadequate search tag handling on DAO layer; current implementation fails on special symbols like '.
          Hide
          Permalink
          Vtech Targa Florio added a comment - - edited

          You are right, it's filter all special characters except '
          I'll rename this issue

          Show
          Vtech Targa Florio added a comment - - edited You are right, it's filter all special characters except ' I'll rename this issue
          Hide
          Permalink
          shogun Anuar Nurmakanov added a comment -

          I'll fix.

          Show
          shogun Anuar Nurmakanov added a comment - I'll fix.
          Hide
          Permalink
          jk1 Evgeniy Naumenko added a comment - - edited

          Backslash is also causing similar problems. On retest I suggest to check all special characters carefully.

          Show
          jk1 Evgeniy Naumenko added a comment - - edited Backslash is also causing similar problems. On retest I suggest to check all special characters carefully.
          Hide
          Permalink
          varro Artem R added a comment - - edited

          Steps to reproduce
          1. Enter

          '`

          in Tags Filter field

          Actual result
          Error 500 is shown

          Expected result
          Search by entered tag should be perfomed

          Issue should be reopened

          Show
          varro Artem R added a comment - - edited Steps to reproduce 1. Enter '` in Tags Filter field Actual result Error 500 is shown Expected result Search by entered tag should be perfomed Issue should be reopened
          Hide
          Permalink
          jk1 Evgeniy Naumenko added a comment -

          reimplemented to use proper symbol escaping

          Show
          jk1 Evgeniy Naumenko added a comment - reimplemented to use proper symbol escaping
          Hide
          Permalink
          Vtech Targa Florio added a comment - - edited

          Test Environment
          Firefox 28, Antarcticle 285 build

          Test Scenario
          1. Open Antarcticle main page
          2. Enter special character '` in tags filter
          AR=ER Nothing was found and no error appeared

          Regression tests:
          Search by list special characters (one by one) was tested
          List contains 29 special characters

          Test results:
          AR=ER No errors occurred while searching by special characters

          Show
          Vtech Targa Florio added a comment - - edited Test Environment Firefox 28, Antarcticle 285 build Test Scenario 1. Open Antarcticle main page 2. Enter special character '` in tags filter AR=ER Nothing was found and no error appeared Regression tests: Search by list special characters (one by one) was tested List contains 29 special characters Test results: AR=ER No errors occurred while searching by special characters

            People

            • Assignee:
              Vtech Targa Florio
              Reporter:
              Vtech Targa Florio
            • Votes:
              0 Vote for this issue
              Watchers:
              Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Structure Helper Panel