t-artistik / browserscope

Automatically exported from code.google.com/p/browserscope
Apache License 2.0
0 stars 0 forks source link

"Crud" on version level change with results. #170

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago
What steps will reproduce the problem?
1. Run the tests.
2. View the results page.
3. Change the version level (e.g. to "Browser Family" or "All Versions"

Gives Erorr: Crud. We encountered a problem on our server.
What happens is the URL is not escaped properly. Here is a snippet from the 
url:

"[...],Block%20XSS%20in%20CSS=1amp;richtext_results=apply=39,unapply=23,[..
]"
Notice that the ampersand before richtext_results is messed up.

Perhaps this is a Chrome 5 bug.

Here is the results link that causes the problem:
http://bit.ly/9smoEH

The url looks okay. I suspect it is the version level form that is messing 
things up. I am still investigating.

I see this on Chrome 5 and Firefox 3.5.

Please use labels and text to provide additional information.

Original issue reported on code.google.com by steve.lamm on 6 Feb 2010 at 12:18

GoogleCodeExporter commented 8 years ago
Here is the change that introduced the bug:

http://code.google.com/p/browserscope/source/detail?r=411

In util.js:

   411     elsigh   if (opt_results) {
   411     elsigh     url += '&' + opt_results.replace('&', '');
   411     elsigh   }

elsigh, do you remember why you called 'replace' there?

Original comment by steve.lamm on 8 Feb 2010 at 9:18

GoogleCodeExporter commented 8 years ago
This looks like it should be removed based on our chat.
Feel free to make the change, and also re-run the js-build to reproduce the 
compiled 
js file. Thanks!

Original comment by els...@gmail.com on 8 Feb 2010 at 9:41

GoogleCodeExporter commented 8 years ago
Fixed in revision 512.

Original comment by steve.lamm on 11 Feb 2010 at 12:51