← Back to branch summary

~ubuntu-branches/ubuntu/natty/empathy/natty-updates

« back to all changes in this revision

Viewing changes to debian/patches/75_empathy-CVE-2011-3635-lp879301.patch

  • Committer: Package Import Robot
  • Author(s): Steve Beattie
  • Date: 2011-10-25 15:21:46 UTC
  • mfrom: (146.1.1 natty-proposed)
  • Revision ID: package-import@ubuntu.com-20111025152146-wxc49chnws08v608
Tags: 2.34.0-0ubuntu3.2
https://launchpad.net/bugs/879301
* SECURITY UPDATE: remote HTML injection (LP: #879301)
  - debian/patches/75_empathy-CVE-2011-3635-lp879301.patch: escape
    HTML in when displaying other users' names. (Thanks to upstream
    for patch.)
  - CVE-2011-3635, CVE-2011-4170

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/75_empathy-CVE-2011-3635-lp879301.patch
 
1
From 739aca418457de752be13721218aaebc74bd9d36 Mon Sep 17 00:00:00 2001
 
2
From: Guillaume Desmottes <guillaume.desmottes@collabora.co.uk>
 
3
Date: Tue, 18 Oct 2011 16:32:52 +0000
 
4
Subject: theme_adium_append_message: escape alias before displaying it
 
5
 
 
6
Not doing so can lead to nasty HTML injection from hostile users.
 
7
 
 
8
https://bugzilla.gnome.org/show_bug.cgi?id=662035
 
9
 
 
10
and
 
11
 
 
12
From 15a4eec2f156c4f60398a9d842279203f475ed89 Mon Sep 17 00:00:00 2001
 
13
From: Guillaume Desmottes <guillaume.desmottes@collabora.co.uk>
 
14
Date: Mon, 24 Oct 2011 08:31:55 +0000
 
15
Subject: theme-adium: escape the name in actions as well
 
16
 
 
17
CVE-2011-3635 and CVE-2011-4170
 
18
 
 
19
[Ubuntu note: backported patch to 2.34 version -- sbeattie]
 
20
 
 
21
---
 
22
 libempathy-gtk/empathy-theme-adium.c |   10 +++++++---
 
23
 1 file changed, 7 insertions(+), 3 deletions(-)
 
24
 
 
25
Index: b/libempathy-gtk/empathy-theme-adium.c
 
26
===================================================================
 
27
--- a/libempathy-gtk/empathy-theme-adium.c
 
28
+++ b/libempathy-gtk/empathy-theme-adium.c
 
29
@@ -436,7 +436,7 @@ theme_adium_append_message (EmpathyChatV
 
30
        EmpathyThemeAdiumPriv *priv = GET_PRIV (theme);
 
31
        EmpathyContact        *sender;
 
32
        TpAccount             *account;
 
33
-       gchar                 *body_escaped;
 
34
+       gchar                 *body_escaped, *name_escaped;
 
35
        const gchar           *body;
 
36
        const gchar           *name;
 
37
        const gchar           *contact_id;
 
38
@@ -470,15 +470,18 @@ theme_adium_append_message (EmpathyChatV
 
39
        name = empathy_contact_get_alias (sender);
 
40
        contact_id = empathy_contact_get_id (sender);
 
41
 
 
42
+       name_escaped = g_markup_escape_text (name, -1);
 
43
+
 
44
        /* If this is a /me, append an event */
 
45
        if (empathy_message_get_tptype (msg) == TP_CHANNEL_TEXT_MESSAGE_TYPE_ACTION) {
 
46
                gchar *str;
 
47
 
 
48
-               str = g_strdup_printf ("%s %s", name, body_escaped);
 
49
+               str = g_strdup_printf ("%s %s", name_escaped, body_escaped);
 
50
                theme_adium_append_event_escaped (view, str);
 
51
 
 
52
                g_free (str);
 
53
                g_free (body_escaped);
 
54
+               g_free (name_escaped);
 
55
                return;
 
56
        }
 
57
 
 
58
@@ -600,7 +603,7 @@ theme_adium_append_message (EmpathyChatV
 
59
 
 
60
        if (html != NULL) {
 
61
                theme_adium_append_html (theme, func, html, len, body_escaped,
 
62
-                                        avatar_filename, name, contact_id,
 
63
+                                        avatar_filename, name_escaped, contact_id,
 
64
                                         service_name, message_classes->str,
 
65
                                         timestamp, is_backlog);
 
66
        } else {
 
67
@@ -616,6 +619,7 @@ theme_adium_append_message (EmpathyChatV
 
68
        priv->last_is_backlog = is_backlog;
 
69
 
 
70
        g_free (body_escaped);
 
71
+       g_free (name_escaped);
 
72
        g_string_free (message_classes, TRUE);
 
73
 }
 
74