Re: Bug#853189: tracker.debian.org: Ecnoding issue / Code injection through Maintainer field (and probably others)

[Niels Thykier <niels@thykier.net>]

Christophe Siraut:
> Niels Thykier wrote:
>>  * tracker.d.o does *not* import excuses.yaml but update_excuses.html
>>    (as far as I am informed at least)
> 
> True.
> 
> Here is a patch for tracker to parse YAML instead of HTML.
> 
> Cheers,
> Christophe
> 

Hi Christophe,

Thanks for looking into this issue. :)

As the maintainer of Britney, I am a bit concerned that this patch
appears to be relying on the "excuses"-field inside.  That is a
"non-machine"-parsable format (basically all raw HTML notes) that I
would like to eventually phase out of the excuses.yaml.

If there is data in that field that tracker needs, then it should
preferably be extracted to another field.  (FTR, the format is still a
bit WIP)

Thanks,
~Niels