Files
@ 603f5f7c323d
Branch filter:
Location: kallithea/docs/usage/debugging.rst - annotation
603f5f7c323d
1.2 KiB
text/prs.fallenstein.rst
pullrequests: prevent XSS in 'Potential Reviewers' list when first and last names cannot be trusted
If a user first or last name contains javascript, these fields need proper
escaping to avoid XSS attacks.
An example scenario is:
- the malicious user creates a repository. This will cause this user to be
listed automatically under 'Potential Reviewers' in pull requests.
- another user creates a pull request on that repository and selects the
suggested reviewer from the 'Potential Reviewers' list.
Reported by Bob Hogg <wombat@rwhogg.site> (thanks!).
Technical note: the other caller of addReviewMember in base.js itself does
_not_ need to be adapted to escape the input values, because the input
values (oData) are _already_ escaped (by the YUI framework).
If a user first or last name contains javascript, these fields need proper
escaping to avoid XSS attacks.
An example scenario is:
- the malicious user creates a repository. This will cause this user to be
listed automatically under 'Potential Reviewers' in pull requests.
- another user creates a pull request on that repository and selects the
suggested reviewer from the 'Potential Reviewers' list.
Reported by Bob Hogg <wombat@rwhogg.site> (thanks!).
Technical note: the other caller of addReviewMember in base.js itself does
_not_ need to be adapted to escape the input values, because the input
values (oData) are _already_ escaped (by the YUI framework).
4d076981a7b1 4d076981a7b1 4d076981a7b1 e73a69cb98dc 4d076981a7b1 4d076981a7b1 4e6dfdb3fa01 4e6dfdb3fa01 4d076981a7b1 4e6dfdb3fa01 4d076981a7b1 fbbe80e3322b 03bbd33bc084 4d076981a7b1 4d076981a7b1 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 097327aaf2ad 4d076981a7b1 4d076981a7b1 03bbd33bc084 4d076981a7b1 4d076981a7b1 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 4e6dfdb3fa01 | .. _debugging:
===================
Debugging Kallithea
===================
If you encounter problems with Kallithea, here are some instructions
on how to debug them.
.. note:: First make sure you're using the latest version available.
Enable detailed debug
---------------------
Kallithea uses the standard Python ``logging`` module to log its output.
By default only loggers with ``INFO`` level are displayed. To enable full output
change ``level = DEBUG`` for all logging handlers in the currently used .ini file.
This change will allow you to see much more detailed output in the log file or
console. This generally helps a lot to track issues.
Enable interactive debug mode
-----------------------------
To enable interactive debug mode simply comment out ``set debug = false`` in
the .ini file. This will trigger an interactive debugger each time
there is an error in the browser, or send a http link if an error occured in the backend. This
is a great tool for fast debugging as you get a handy Python console right
in the web view.
.. warning:: NEVER ENABLE THIS ON PRODUCTION! The interactive console
can be a serious security threat to your system.
|