Bug 34023 - HTML injection in "back to results" link from search page
Summary: HTML injection in "back to results" link from search page
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Searching (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: Michał Górny
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-06-15 13:04 UTC by Michał Górny
Modified: 2024-08-15 13:27 UTC (History)
13 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.02
Circulation function:


Attachments
Trivial patch (483 bytes, patch)
2023-06-15 13:04 UTC, Michał Górny
Details | Diff | Splinter Review
Bug 34023: Prevent HTML injection in "back to results" link from search page (1.72 KB, patch)
2023-06-16 14:36 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 34023: Prevent HTML injection in "back to results" link from search page (1.82 KB, patch)
2023-07-25 10:47 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Michał Górny 2023-06-15 13:04:53 UTC
Created attachment 152382 [details] [review]
Trivial patch

It is possible inject raw HTML into the "Back to search results" link by leading the user to a search with specially crafted URL.

For example, using the demo instance:

1. Visit https://koha.adminkuhn.ch/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1&%22%3Etest%3Ca%20foo=%22

2. Refresh the page (for some reason, "back to results" doesn't appear unless I do that at least once).

3. Click any result.

Note that the result page now contains:

  <a href="opac-search.pl?idx=&amp;q=test&amp;weight_search=1&amp;">test<a foo=%22" title="...

i.e. `">test<a ...` was successfully injected into the HTML.


I'm attaching a quick patch I've used to patch up our instance.  It just indiscriminately URI-escapes all parameter keys.  I didn't decode them back since as far as I understand all valid keys do not contain special characters.
Comment 1 Jonathan Druart 2023-06-16 14:36:15 UTC
Created attachment 152420 [details] [review]
Bug 34023: Prevent HTML injection in "back to results" link from search page

It is possible inject raw HTML into the "Back to search results" link by leading the user to a search with specially crafted URL.

For example, using the demo instance:

1. Visit https://koha.adminkuhn.ch/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1&%22%3Etest%3Ca%20foo=%22

2. Refresh the page (for some reason, "back to results" doesn't appear unless I do that at least once).

3. Click any result.

Note that the result page now contains:

  <a href="opac-search.pl?idx=&amp;q=test&amp;weight_search=1&amp;">test<a foo=%22" title="...

i.e. `">test<a ...` was successfully injected into the HTML.

I'm attaching a quick patch I've used to patch up our instance.  It just indiscriminately URI-escapes all parameter keys.  I didn't decode them back since as far as I understand all valid keys do not contain special characters.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 2 David Cook 2023-07-25 06:15:43 UTC
I'll look at this one tomorrow
Comment 3 Marcel de Rooy 2023-07-25 10:47:12 UTC
There is not much checking here with $raw:

koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt:                                    <a href="opac-search.pl?[% busc | $raw %]" title="Back to the results search list">Back to results</a>

This whole busc code is not very clear.

But the patch is a quick solution. And seems(!) not to create encoding problems.
Comment 4 Marcel de Rooy 2023-07-25 10:47:53 UTC
Created attachment 153865 [details] [review]
Bug 34023: Prevent HTML injection in "back to results" link from search page

It is possible inject raw HTML into the "Back to search results" link by leading the user to a search with specially crafted URL.

For example, using the demo instance:

1. Visit https://koha.adminkuhn.ch/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1&%22%3Etest%3Ca%20foo=%22

2. Refresh the page (for some reason, "back to results" doesn't appear unless I do that at least once).

3. Click any result.

Note that the result page now contains:

  <a href="opac-search.pl?idx=&amp;q=test&amp;weight_search=1&amp;">test<a foo=%22" title="...

i.e. `">test<a ...` was successfully injected into the HTML.

I'm attaching a quick patch I've used to patch up our instance.  It just indiscriminately URI-escapes all parameter keys.  I didn't decode them back since as far as I understand all valid keys do not contain special characters.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 5 David Cook 2023-07-27 02:09:20 UTC
Thanks for looking at that one, Marcel.
Comment 6 Tomás Cohen Arazi 2023-07-27 18:47:04 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 7 Fridolin Somers 2023-08-08 06:24:22 UTC
Pushed to 23.05.x for 23.05.02