Bug 17023 - z3950_search.pl are vulnerable to XSS attacks
Summary: z3950_search.pl are vulnerable to XSS attacks
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 14568
  Show dependency treegraph
 
Reported: 2016-08-02 14:08 UTC by Jonathan Druart
Modified: 2019-06-27 09:24 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Bug 17023: Fix XSS in cataloguing/z3950_search.pl (10.78 KB, patch)
2016-08-02 14:28 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 17023: Fix XSS in acqui/z3950_search.pl (11.50 KB, patch)
2016-08-02 14:29 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 17023: Fix XSS in cataloguing/z3950_search.pl (10.83 KB, patch)
2016-08-03 20:54 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 17023: Fix XSS in acqui/z3950_search.pl (11.55 KB, patch)
2016-08-03 20:54 UTC, Chris Cormack
Details | Diff | Splinter Review
[PASSED QA] Bug 17023: Fix XSS in cataloguing/z3950_search.pl (10.90 KB, patch)
2016-08-03 21:36 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 17023: Fix XSS in acqui/z3950_search.pl (11.63 KB, patch)
2016-08-03 21:36 UTC, Katrin Fischer
Details | Diff | Splinter Review
[3.20.x] Bug 17023: Fix XSS in cataloguing/z3950_search.pl (8.89 KB, patch)
2016-08-08 11:12 UTC, Jonathan Druart
Details | Diff | Splinter Review
[3.20.x] Bug 17023: Fix XSS in acqui/z3950_search.pl (11.71 KB, patch)
2016-08-08 11:12 UTC, Jonathan Druart
Details | Diff | Splinter Review
[3.22.x] Bug 17023: Fix XSS in cataloguing/z3950_search.pl (8.83 KB, patch)
2016-08-17 12:51 UTC, Julian Maurice
Details | Diff | Splinter Review
[3.22.x] Bug 17023: Fix XSS in acqui/z3950_search.pl (12.11 KB, patch)
2016-08-17 12:51 UTC, Julian Maurice
Details | Diff | Splinter Review
Bug 17023: Repair "cancel" link (1.27 KB, patch)
2016-08-22 12:09 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2016-08-02 14:08:27 UTC
Reported by Dionach.
Comment 1 Jonathan Druart 2016-08-02 14:28:51 UTC Comment hidden (obsolete)
Comment 2 Jonathan Druart 2016-08-02 14:29:13 UTC Comment hidden (obsolete)
Comment 3 Chris Cormack 2016-08-03 20:54:32 UTC Comment hidden (obsolete)
Comment 4 Chris Cormack 2016-08-03 20:54:51 UTC Comment hidden (obsolete)
Comment 5 Katrin Fischer 2016-08-03 21:36:04 UTC
Created attachment 53975 [details] [review]
[PASSED QA] Bug 17023: Fix XSS in cataloguing/z3950_search.pl

Test plan:
Enter the following in the different inputs:
<script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 6 Katrin Fischer 2016-08-03 21:36:36 UTC
Created attachment 53976 [details] [review]
[PASSED QA] Bug 17023: Fix XSS in acqui/z3950_search.pl

Test plan:
Enter the following in the different inputs:
<script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 7 Brendan Gallagher 2016-08-04 18:46:54 UTC
Pushed to Master - Should be in the November 2016 release.  Thanks!
Comment 8 Frédéric Demians 2016-08-05 06:10:22 UTC
Pushed in 16.05. Will be in 16.05.03.
Comment 9 Chris Cormack 2016-08-08 07:03:24 UTC
Does not apply cleanly to 3.20.x
Comment 10 Jonathan Druart 2016-08-08 11:12:49 UTC
Created attachment 54149 [details] [review]
[3.20.x] Bug 17023: Fix XSS in cataloguing/z3950_search.pl

Test plan:
Enter the following in the different inputs:
<script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 11 Jonathan Druart 2016-08-08 11:12:59 UTC
Created attachment 54150 [details] [review]
[3.20.x] Bug 17023: Fix XSS in acqui/z3950_search.pl

Test plan:
Enter the following in the different inputs:
<script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 12 Chris Cormack 2016-08-08 20:12:09 UTC
Thank you Jonathan, pushed to 3.20.x will be in 3.20.14
Comment 13 Julian Maurice 2016-08-17 12:34:35 UTC
In 4th chunk of attachment 53976 [details] [review],
 [% basketno %] is changed into [% url %]
I think it's not intended

In attachment 54150 [details] [review] (for 3.20.x), it's corrected to [% basketno | url %]

Also, why use 'url' filter here whereas the 'uri' filter is used everywhere else ?
Comment 14 Julian Maurice 2016-08-17 12:51:09 UTC
Created attachment 54533 [details] [review]
[3.22.x] Bug 17023: Fix XSS in cataloguing/z3950_search.pl

Test plan:
Enter the following in the different inputs:
<script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit f6e0a619d974fe002ec6a920206c7bc2808bce26)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
(cherry picked from commit 98c6d7873535d52609657ecaf256740c95c0e532)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 15 Julian Maurice 2016-08-17 12:51:20 UTC
Created attachment 54534 [details] [review]
[3.22.x] Bug 17023: Fix XSS in acqui/z3950_search.pl

Test plan:
Enter the following in the different inputs:
<script>alert('XSS')</script>

=> Without this patch you will see the alert
=> With this patch, no more alert

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
(cherry picked from commit eb543a90848b97d35aa15052c8881134926a3ed0)
Signed-off-by: Frédéric Demians <f.demians@tamil.fr>
(cherry picked from commit 7cb27f092a4c699fcd428083383eef6f515da3e3)
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 16 Jonathan Druart 2016-08-18 09:16:27 UTC
(In reply to Julian Maurice from comment #13)
> In 4th chunk of attachment 53976 [details] [review] [review],
>  [% basketno %] is changed into [% url %]
> I think it's not intended
> 
> In attachment 54150 [details] [review] [review] (for 3.20.x), it's corrected to [%
> basketno | url %]
> 
> Also, why use 'url' filter here whereas the 'uri' filter is used everywhere
> else ?

It's a mistake, should be uri of course.
Comment 17 Julian Maurice 2016-08-22 07:00:08 UTC
Patches pushed to 3.22.x, will be in 3.22.10

Should I open a new bug to fix the "[% url %] => [% basketno | uri %]" problem in master ?
Comment 18 Jonathan Druart 2016-08-22 10:22:09 UTC
(In reply to Julian Maurice from comment #17)
> Patches pushed to 3.22.x, will be in 3.22.10
> 
> Should I open a new bug to fix the "[% url %] => [% basketno | uri %]"
> problem in master ?

It seems that it only appear in 3.20, Chris could you please patch it?
Comment 19 Julian Maurice 2016-08-22 11:42:55 UTC
(In reply to Jonathan Druart from comment #18)
> (In reply to Julian Maurice from comment #17)
> > Patches pushed to 3.22.x, will be in 3.22.10
> > 
> > Should I open a new bug to fix the "[% url %] => [% basketno | uri %]"
> > problem in master ?
> 
> It seems that it only appear in 3.20, Chris could you please patch it?

In 3.20.x, it's [% basketno | url %], it could be fixed, but it's not a big issue IMO.
In master, it's just [% url %] (line 111)
Comment 20 Jonathan Druart 2016-08-22 12:09:02 UTC
Created attachment 54681 [details] [review]
Bug 17023: Repair "cancel" link

The basketno param has been removed in previous patch.
Comment 21 Jonathan Druart 2016-08-22 12:10:12 UTC
(In reply to Jonathan Druart from comment #20)
> Created attachment 54681 [details] [review] [review]
> Bug 17023: Repair "cancel" link
> 
> The basketno param has been removed in previous patch.

Kyle, Frédéric and Julian, please push this regression fix.
(Do not open a new bug report to make it available for stable releases).
Comment 22 Julian Maurice 2016-08-22 12:19:26 UTC
(In reply to Jonathan Druart from comment #21)
> Kyle, Frédéric and Julian, please push this regression fix.

Already fixed in 3.22.x
Comment 23 Kyle M Hall (khall) 2016-08-22 12:51:37 UTC
Followup 'Bug 17023: Repair "cancel" link ' pushed to master!