The bug list shows you a short text which can be entered at <http: //bugzilla.mozilla.org/newquip.html> by anybody. (Is there any option to turn it off?) It allows HTML, which is sent directly to the bugzilla user. That's a perfect way to exploit Mozilla security holes.

bug 13075 is now about this, but nobody updated the summary of that bug.

This should be marked a duplicate of bug 13075 IMHO.

(13075 is fixed, but this bug is still there, I think.) This bug is sitting around much too long. raising severity to critical, because security relevant. the mozilla.org domain is a testbed for Mozillas (as least, I use it as such) and *has* to be secure.

is there some perl code that does this already?

I have no idea. But you could just escape "<>&" (">" -> &gt; "<" -> "&lt;", "&" -> "&amp;"), and the HTML code would appear in the page as cleartext, without being evaluated by the browser.

This is a dupe and it's been fixed anyway.

cool, tnx! verifying.

I can still enter &'s...

In search of accurate queries.... (sorry for the spam)

Moving closed bugs to Bugzilla product