diff options
| author |   Robin H. Johnson <robbat2@gentoo.org> | 2009-02-10 19:29:35 -0800 |
|---|---|---|
| committer | Robin H. Johnson <robbat2@gentoo.org> | 2009-02-10 19:29:35 -0800 |
| commit | 81e306a88c64249a54398e85ec2cbbdfef394a7a (patch) | |
| tree | 3a388c6e86e00584e4c2035f0fd18051ade72f4f | |
| parent | include a timestamp in the tag. (diff) | |
| download | mysql-extras-81e306a88c64249a54398e85ec2cbbdfef394a7a.tar.gz mysql-extras-81e306a88c64249a54398e85ec2cbbdfef394a7a.tar.bz2 mysql-extras-81e306a88c64249a54398e85ec2cbbdfef394a7a.zip | |
Newer testcase for HTML encoding.mysql-extras-20090211-0329Z
| -rw-r--r-- | 000_index.txt | 8 | ||||
| -rw-r--r-- | 721_all_encode_html_entities_testcase-5.0.76.patch | 34 |
2 files changed, 41 insertions, 1 deletions
diff --git a/000_index.txt b/000_index.txt index 9b02e61..2799ca8 100644 --- a/000_index.txt +++ b/000_index.txt @@ -455,7 +455,13 @@ @@ Fix CVE-2008-4456 XSS in command line client (Gentoo #240407, MySQL #27884) @patch 721_all_encode_html_entities_testcase-5.0.72.patch -@ver 5.00.72.00 to 5.00.99.99 +@ver 5.00.72.00 to 5.00.72.99 +@pn mysql +@pn mysql-community +@@ Testcase for CVE-2008-4456 + +@patch 721_all_encode_html_entities_testcase-5.0.76.patch +@ver 5.00.76.00 to 5.00.99.99 @pn mysql @pn mysql-community @@ Testcase for CVE-2008-4456 diff --git a/721_all_encode_html_entities_testcase-5.0.76.patch b/721_all_encode_html_entities_testcase-5.0.76.patch new file mode 100644 index 0000000..d77af22 --- /dev/null +++ b/721_all_encode_html_entities_testcase-5.0.76.patch @@ -0,0 +1,34 @@ +When using the commandline client and --html, HTML entities are not encoded, +leading to a potential XSS. + +This is the testcase portion from the original patch, ported to 5.0.72. + +Signed-off-by: Robin H. Johnson <robbat2@gentoo.org> +X-Patch-URL: http://bugs.mysql.com/file.php?id=9232 +MySQL-Bug: 27884 +MySQL-Bug-URL: http://bugs.mysql.com/bug.php?id=27884 +Gentoo-Bug: 240407 +Gentoo-Bug-URL: http://bugs.gentoo.org/show_bug.cgi?id=240407 + +diff -Nuar --exclude '*.orig' --exclude '*.rej' mysql.orig/mysql-test/r/mysql.result mysql/mysql-test/r/mysql.result +--- mysql.orig/mysql-test/r/mysql.result 2009-01-15 10:45:22.000000000 -0800 ++++ mysql/mysql-test/r/mysql.result 2009-02-10 19:27:04.046576272 -0800 +@@ -186,4 +186,5 @@ + 2 + 2 + 2 ++<TABLE BORDER=1><TR><TH><</TH></TR><TR><TD>< & ></TD></TR></TABLE> + End of 5.0 tests +diff -Nuar --exclude '*.orig' --exclude '*.rej' mysql.orig/mysql-test/t/mysql.test mysql/mysql-test/t/mysql.test +--- mysql.orig/mysql-test/t/mysql.test 2009-01-15 10:44:56.000000000 -0800 ++++ mysql/mysql-test/t/mysql.test 2009-02-10 19:26:33.346202977 -0800 +@@ -309,4 +309,9 @@ + --exec $MYSQL -c < $MYSQLTEST_VARDIR/tmp/bug38158.sql 2>&1 + remove_file $MYSQLTEST_VARDIR/tmp/bug38158.sql; + ++# ++# Bug #27884: mysql --html does not quote HTML special characters in output ++# ++--exec $MYSQL --html test -e "select '< & >' as \`<\`" ++ + --echo End of 5.0 tests |