Bug 11307

Summary: Potential XSS attack vector in opac rss feed
Product: Koha Reporter: Chris Cormack <chris>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: critical    
Priority: P5 - low CC: arunet, fridolin.somers, gmcharlt, martin.renvoize, mtompset, tomascohen
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 11307 : Potential XSS attack in rss feed
Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only)
Bug 11307 : Potential XSS attack in rss feed
Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only)
[PASSED QA] Bug 11307 : Potential XSS attack in rss feed
[PASSED QA] Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only)

Description Chris Cormack 2013-11-26 16:37:20 UTC
http://demo.mykoha.co.nz/cgi-bin/koha/opac-search.pl?idx=kw&amp;q=a&amp;count=50%22%27%3Ch1%3Etest%3C/h1%3E&amp;sort_by=acqdate_dsc&amp;format=rss2

If you look at the source you will see 
<opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage>
Comment 1 Chris Cormack 2013-11-26 16:40:03 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2013-11-26 16:52:57 UTC Comment hidden (obsolete)
Comment 3 Mark Tompsett 2013-11-26 17:04:37 UTC Comment hidden (obsolete)
Comment 4 Mark Tompsett 2013-11-26 17:04:52 UTC Comment hidden (obsolete)
Comment 5 Mark Tompsett 2013-11-26 17:08:47 UTC
Tested according to test plan given in comment #1 for prog and bootstrap themes.
Comment 6 Martin Renvoize 2013-11-26 17:42:19 UTC
Created attachment 23175 [details] [review]
[PASSED QA] Bug 11307 : Potential XSS attack in rss feed

To test:
1/ Craft a url like
/cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2
2/ look at the source, notice
<opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage>
3/ apply the patch, and reload url
4/ source now contains
 <opensearch:itemsPerPage>50&quot;'&lt;h1&gt;test&lt;/h1&gt;</opensearch:itemsPerPage>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 7 Martin Renvoize 2013-11-26 17:43:24 UTC
Created attachment 23176 [details] [review]
[PASSED QA] Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only)

To test:
Same as first patch, but using bootstrap theme

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 8 Martin Renvoize 2013-11-26 17:57:10 UTC
All works as expected, passes QA script.
Comment 9 Galen Charlton 2013-11-26 18:18:41 UTC
Pushed to master and 3.14.x.  Thanks, Chris!
Comment 10 Fridolin Somers 2013-12-13 12:58:05 UTC
Patches will be in 3.14.1
Comment 11 Tomás Cohen Arazi 2013-12-16 13:32:21 UTC
This patch has been pushed to 3.12.x, will be in 3.12.8.

Thanks Chris!