From turnbull at sk.tsukuba.ac.jp  Mon Jan  6 06:14:25 2014
From: turnbull at sk.tsukuba.ac.jp (Stephen J. Turnbull)
Date: Mon, 06 Jan 2014 14:14:25 +0900
Subject: [Tracker-discuss] Fwd: [PSRT] Cross-Site
	Scripting(XSS)	vulnerability found on your website
In-Reply-To: <CAPZV6o8i-6-=t7TsM8_Yx6pFKtf3VUiYDWNYwqyuAir5PUJMxw@mail.gmail.com>
References: <CA+6GLh4r9xuyUKLvkeUz+EMPTKjt3G5o9aD8Khon_uv-OY2eug@mail.gmail.com>
 <CAPZV6o8i-6-=t7TsM8_Yx6pFKtf3VUiYDWNYwqyuAir5PUJMxw@mail.gmail.com>
Message-ID: <87r48lite6.fsf@uwakimon.sk.tsukuba.ac.jp>

Benjamin Peterson writes:

 > Not sure if this is interesting.

 > 2. As soon as we submit the crafted URL, we get an alert box saying XSS.
 >    URL:
 >
 >    http://bugs.python.org/issue?%40columns=status&message_count="><script>alert("XSS")<%2Fscript>&%40action=search

Sure, this is interesting (it works as advertised for me on Mac OS X
with Firefox 26.0, and could be used for phishing at least).

I don't know what, if anything, we can do about it, but if we can
prevent it without unreasonable effort, we should.


From rdmurray at bitdance.com  Mon Jan  6 16:30:59 2014
From: rdmurray at bitdance.com (R. David Murray)
Date: Mon, 06 Jan 2014 10:30:59 -0500
Subject: [Tracker-discuss] Fwd: [PSRT] Cross-Site Scripting(XSS)
	vulnerability found on your website
In-Reply-To: <87r48lite6.fsf@uwakimon.sk.tsukuba.ac.jp>
References: <CA+6GLh4r9xuyUKLvkeUz+EMPTKjt3G5o9aD8Khon_uv-OY2eug@mail.gmail.com>
 <CAPZV6o8i-6-=t7TsM8_Yx6pFKtf3VUiYDWNYwqyuAir5PUJMxw@mail.gmail.com>
 <87r48lite6.fsf@uwakimon.sk.tsukuba.ac.jp>
Message-ID: <20140106153059.F0BD1250186@webabinitio.net>

On Mon, 06 Jan 2014 14:14:25 +0900, "Stephen J. Turnbull" <turnbull at sk.tsukuba.ac.jp> wrote:
> Benjamin Peterson writes:
> 
>  > Not sure if this is interesting.
> 
>  > 2. As soon as we submit the crafted URL, we get an alert box saying XSS.
>  >    URL:
>  >
>  >    http://bugs.python.org/issue?%40columns=status&message_count="><script>alert("XSS")<%2Fscript>&%40action=search
> 
> Sure, this is interesting (it works as advertised for me on Mac OS X
> with Firefox 26.0, and could be used for phishing at least).
> 
> I don't know what, if anything, we can do about it, but if we can
> prevent it without unreasonable effort, we should.

It's "just" a matter of making sure roundup html-escapes values that
it substitutes into error messages.  IOW this is a roundup bug.  But
Ezio is a Roundup dev, so getting a fix pushed upstream once we
have one shouldn't be a problem.

Of course, someone needs to find time to do it...

--David

From roundup-admin at psf.upfronthosting.co.za  Tue Jan 21 06:31:29 2014
From: roundup-admin at psf.upfronthosting.co.za (Python tracker)
Date: Tue, 21 Jan 2014 05:31:29 +0000
Subject: [Tracker-discuss] Failed issue tracker submission
Message-ID: <20140121053129.59C40567F8@psf.upfronthosting.co.za>



The node specified by the designator in the subject of your message
("21222") does not exist.

Subject was: "[issue21222]"



Mail Gateway Help
=================
Incoming messages are examined for multiple parts:
 . In a multipart/mixed message or part, each subpart is extracted and
   examined. The text/plain subparts are assembled to form the textual
   body of the message, to be stored in the file associated with a "msg"
   class node. Any parts of other types are each stored in separate files
   and given "file" class nodes that are linked to the "msg" node.
 . In a multipart/alternative message or part, we look for a text/plain
   subpart and ignore the other parts.
 . A message/rfc822 is treated similar tomultipart/mixed (except for
   special handling of the first text part) if unpack_rfc822 is set in
   the mailgw config section.

Summary
-------
The "summary" property on message nodes is taken from the first non-quoting
section in the message body. The message body is divided into sections by
blank lines. Sections where the second and all subsequent lines begin with
a ">" or "|" character are considered "quoting sections". The first line of
the first non-quoting section becomes the summary of the message.

Addresses
---------
All of the addresses in the To: and Cc: headers of the incoming message are
looked up among the user nodes, and the corresponding users are placed in
the "recipients" property on the new "msg" node. The address in the From:
header similarly determines the "author" property of the new "msg"
node. The default handling for addresses that don't have corresponding
users is to create new users with no passwords and a username equal to the
address. (The web interface does not permit logins for users with no
passwords.) If we prefer to reject mail from outside sources, we can simply
register an auditor on the "user" class that prevents the creation of user
nodes with no passwords.

Actions
-------
The subject line of the incoming message is examined to determine whether
the message is an attempt to create a new item or to discuss an existing
item. A designator enclosed in square brackets is sought as the first thing
on the subject line (after skipping any "Fwd:" or "Re:" prefixes).

If an item designator (class name and id number) is found there, the newly
created "msg" node is added to the "messages" property for that item, and
any new "file" nodes are added to the "files" property for the item.

If just an item class name is found there, we attempt to create a new item
of that class with its "messages" property initialized to contain the new
"msg" node and its "files" property initialized to contain any new "file"
nodes.

Triggers
--------
Both cases may trigger detectors (in the first case we are calling the
set() method to add the message to the item's spool; in the second case we
are calling the create() method to create a new node). If an auditor raises
an exception, the original message is bounced back to the sender with the
explanatory message given in the exception.
-------------- next part --------------
Return-Path: <tracker-discuss at python.org>
X-Original-To: report at bugs.python.org
Delivered-To: roundup+tracker at psf.upfronthosting.co.za
Received: from mail.python.org (mail.python.org [82.94.164.166])
	by psf.upfronthosting.co.za (Postfix) with ESMTPS id 102AB560D0
	for <report at bugs.python.org>; Tue, 21 Jan 2014 06:31:29 +0100 (CET)
Received: from albatross.python.org (localhost [127.0.0.1])
	by mail.python.org (Postfix) with ESMTP id 3f7ddr55cCz7Ljk
	for <report at bugs.python.org>; Tue, 21 Jan 2014 06:31:28 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=python.org; s=200901;
	t=1390282288; bh=3LqmZvQv67ppXUqnm6VkkKZE3TP2ZsLY8/pU9OSjN0s=;
	h=From:To:Subject:Date:From;
	b=AkBUqMObXyR6GxUHLzkbC0+2ugLKfkVYUq/fPMdanH+PTKUxCg2Qv/UXq0vCww+aM
	 UHtX2owvVFTXRFq2X3DVgkAsIycQfkxyytqMQr5je+A3kM63L7X4aqA5l+CS6W9dqr
	 pfbggvvniSjpGYGJG4IySTkOK+bPANo2gI4sSDkk=
Received: from localhost (HELO mail.python.org) (127.0.0.1)
  by albatross.python.org with SMTP; 21 Jan 2014 06:31:28 +0100
Received: from virt-7yvsjn.psf.osuosl.org (unknown [140.211.10.72])
	by mail.python.org (Postfix) with ESMTP
	for <report at bugs.python.org>; Tue, 21 Jan 2014 06:31:28 +0100 (CET)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
From: tracker-discuss at python.org
To: report at bugs.python.org
Subject: [issue21222]
Message-Id: <3f7ddr55cCz7Ljk at mail.python.org>
Date: Tue, 21 Jan 2014 06:31:28 +0100 (CET)

TmV3IGNoYW5nZXNldCA2NDlhM2U2Y2U5MmUgYnkgVGVycnkgSmFuIFJlZWR5IGluIGJyYW5jaCAn
Mi43JzoKSXNzdWUgIzIxMjIyOiBXaGl0ZXNwYWNlCmh0dHA6Ly9oZy5weXRob24ub3JnL2NweXRo
b24vcmV2LzY0OWEzZTZjZTkyZQo=

From roundup-admin at psf.upfronthosting.co.za  Wed Jan 22 03:13:47 2014
From: roundup-admin at psf.upfronthosting.co.za (Python tracker)
Date: Wed, 22 Jan 2014 02:13:47 +0000
Subject: [Tracker-discuss] Failed issue tracker submission
Message-ID: <20140122021347.4C9FA560CD@psf.upfronthosting.co.za>



The node specified by the designator in the subject of your message
("20818") does not exist.

Subject was: "[issue20818]"



Mail Gateway Help
=================
Incoming messages are examined for multiple parts:
 . In a multipart/mixed message or part, each subpart is extracted and
   examined. The text/plain subparts are assembled to form the textual
   body of the message, to be stored in the file associated with a "msg"
   class node. Any parts of other types are each stored in separate files
   and given "file" class nodes that are linked to the "msg" node.
 . In a multipart/alternative message or part, we look for a text/plain
   subpart and ignore the other parts.
 . A message/rfc822 is treated similar tomultipart/mixed (except for
   special handling of the first text part) if unpack_rfc822 is set in
   the mailgw config section.

Summary
-------
The "summary" property on message nodes is taken from the first non-quoting
section in the message body. The message body is divided into sections by
blank lines. Sections where the second and all subsequent lines begin with
a ">" or "|" character are considered "quoting sections". The first line of
the first non-quoting section becomes the summary of the message.

Addresses
---------
All of the addresses in the To: and Cc: headers of the incoming message are
looked up among the user nodes, and the corresponding users are placed in
the "recipients" property on the new "msg" node. The address in the From:
header similarly determines the "author" property of the new "msg"
node. The default handling for addresses that don't have corresponding
users is to create new users with no passwords and a username equal to the
address. (The web interface does not permit logins for users with no
passwords.) If we prefer to reject mail from outside sources, we can simply
register an auditor on the "user" class that prevents the creation of user
nodes with no passwords.

Actions
-------
The subject line of the incoming message is examined to determine whether
the message is an attempt to create a new item or to discuss an existing
item. A designator enclosed in square brackets is sought as the first thing
on the subject line (after skipping any "Fwd:" or "Re:" prefixes).

If an item designator (class name and id number) is found there, the newly
created "msg" node is added to the "messages" property for that item, and
any new "file" nodes are added to the "files" property for the item.

If just an item class name is found there, we attempt to create a new item
of that class with its "messages" property initialized to contain the new
"msg" node and its "files" property initialized to contain any new "file"
nodes.

Triggers
--------
Both cases may trigger detectors (in the first case we are calling the
set() method to add the message to the item's spool; in the second case we
are calling the create() method to create a new node). If an auditor raises
an exception, the original message is bounced back to the sender with the
explanatory message given in the exception.
-------------- next part --------------
Return-Path: <tracker-discuss at python.org>
X-Original-To: report at bugs.python.org
Delivered-To: roundup+tracker at psf.upfronthosting.co.za
Received: from mail.python.org (mail.python.org [82.94.164.166])
	by psf.upfronthosting.co.za (Postfix) with ESMTPS id F2C84560CB
	for <report at bugs.python.org>; Wed, 22 Jan 2014 03:13:46 +0100 (CET)
Received: from albatross.python.org (localhost [127.0.0.1])
	by mail.python.org (Postfix) with ESMTP id 3f89CG37fyz7Ln4
	for <report at bugs.python.org>; Wed, 22 Jan 2014 03:13:46 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=python.org; s=200901;
	t=1390356826; bh=5zhqEVtWUHf9jVkVGGACEnCGhRes7V0YrJQ5OefsUVU=;
	h=From:To:Subject:Date:From;
	b=YDNCcxozzhGRR3WRjtM8DGLONN6aE07+P3u1o6kEontuHgDR2mrcFSjmLImtllGM6
	 0bHPoRR5fSAB84jD98d95crwTUIiu3Z56LhjmGd73pF4EkE6wawgroHyzt5xXzExRp
	 DQs++4ZO6qRXnTBeeU0X0+8pZ03HGGZKr0FeWvh4=
Received: from localhost (HELO mail.python.org) (127.0.0.1)
  by albatross.python.org with SMTP; 22 Jan 2014 03:13:46 +0100
Received: from virt-7yvsjn.psf.osuosl.org (unknown [140.211.10.72])
	by mail.python.org (Postfix) with ESMTP
	for <report at bugs.python.org>; Wed, 22 Jan 2014 03:13:45 +0100 (CET)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
From: tracker-discuss at python.org
To: report at bugs.python.org
Subject: [issue20818]
Message-Id: <3f89CG37fyz7Ln4 at mail.python.org>
Date: Wed, 22 Jan 2014 03:13:46 +0100 (CET)

TmV3IGNoYW5nZXNldCBjMjhlMDczNzdiMDMgYnkgVGVycnkgSmFuIFJlZWR5IGluIGJyYW5jaCAn
Mi43JzoKSXNzdWUgIzIwODE4OiBSZW1vdmUgY29kZSBmcm9tIGlkbGVsaWIuQ2FsbFRpcFdpbmRv
dy5zaG93dGlwIHRoYXQgaXMgbm93Cmh0dHA6Ly9oZy5weXRob24ub3JnL2NweXRob24vcmV2L2My
OGUwNzM3N2IwMwoKCk5ldyBjaGFuZ2VzZXQgMWI4OWZkNzNjNjI1IGJ5IFRlcnJ5IEphbiBSZWVk
eSBpbiBicmFuY2ggJzMuMyc6Cklzc3VlICMyMDgxODogUmVtb3ZlIGNvZGUgZnJvbSBpZGxlbGli
LkNhbGxUaXBXaW5kb3cuc2hvd3RpcCB0aGF0IGlzIG5vdwpodHRwOi8vaGcucHl0aG9uLm9yZy9j
cHl0aG9uL3Jldi8xYjg5ZmQ3M2M2MjUK