Potential XSS on checkout address page

[John Hawthorn]

Versions Affected: All versions of Spree and Solidus
Not affected: None.
Fixed Versions: Solidus 1.0.5, 1.1.3, 1.2.1
Severity: Medium

Impact
------
It is possible for an attacker to inject HTML onto the address page by
submitting a specially crafted state_name.

By default this is difficult to exploit, as it is only that users cart which
will have the injected HTML. This would be dangerous in sites which support a
"masquerade"-like feature, which allows admins to view the frontend as another
user, exposing them to the exploited cart.

Releases
--------
The fixed releases are available on rubygems as well as in the github branches


Workarounds
-----------

Place the content of the following gist in your application at
app/views/spree/address/_form.html.erb

https://gist.github.com/jhawthorn/8ad13fbdddd5f087c5e6

--
John Hawthorn