mbox series

[layerindex-web,0/4] Security fixes: XSS, bulk change access checks, error disclosure

Message ID 20261020205730.53370-1-tim.orling@konsulko.com
Headers show
Series Security fixes: XSS, bulk change access checks, error disclosure | expand

Message

Tim Orling Oct. 20, 2026, 8:57 p.m. UTC 
These fix security problems found with GitHub CodeQL and manual review.
They were held back until layers.openembedded.org had been updated.

1: Reflected XSS in the recipe CSV export: an invalid "fields" value was
   echoed back as text/html.
2: The bulk change edit, review and patch views had no login or owner
   check, so anyone could view or edit another user's bulk change.
3: Patch generation errors (tracebacks, server paths, BitBake output)
   were returned to the browser.
4: A test for the existing protection that an email change on the
   profile page needs reactivation through the new address.

Tim Orling (4):
  layerindex/views: fix reflected XSS in recipes CSV export
  layerindex: restrict bulk changes to their owner
  layerindex/views: don't expose patch generation errors to users
  tests: check that changing the profile email requires reactivation

 layerindex/urls.py              | 10 ++---
 layerindex/views.py             | 39 ++++++++++++++-----
 tests/test_bulkchange_access.py | 64 +++++++++++++++++++++++++++++++
 tests/test_profile_email.py     | 67 +++++++++++++++++++++++++++++++++
 tests/test_recipes_csv.py       | 33 ++++++++++++++++
 5 files changed, 198 insertions(+), 15 deletions(-)
 create mode 100644 tests/test_bulkchange_access.py
 create mode 100644 tests/test_profile_email.py
 create mode 100644 tests/test_recipes_csv.py


base-commit: 5b55c485d56be9a7314b329ca5d2466a72e7ac48