[SENTRY-1665] cross-site scripting vulnerability in ConfServlet

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.8.0, 2.0.0
• Fix Version/s: 1.8.0, 2.0.0
• Component/s: Sentry
• Labels: bite-sized newbie security
• Assignee: Brian Towles
• Reporter: Alex Kolbasov
• Created: 15/Mar/17 06:41
• Updated: 24/Jul/17 14:51
• Resolved: 09/Jul/17 19:10

Description

The ConfServlet class has the following code:

    String format = request.getParameter(FORMAT_PARAM);
    ...
    } else {
      response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Bad format: " + format);
    }

As a result HTTP parameter is directly written to Servlet error page. Echoing this untrusted input allows for a reflected cross site scripting vulnerability. See http://en.wikipedia.org/wiki/Cross-site_scripting for more information.

Issue Links

• links to: review board