Bug 37655 - XSS vulnerability in basic editor handling of title
Summary: XSS vulnerability in basic editor handling of title
Status: Pushed to oldoldoldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: unspecified
Hardware: All All
: P3 major
Assignee: Phil Ringnalda
QA Contact: David Cook
URL:
Keywords: rel_22_11_candidate
Depends on:
Blocks:
 
Reported: 2024-08-15 21:19 UTC by Phil Ringnalda
Modified: 2025-03-31 09:51 UTC (History)
15 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00,24.05.04,23.11.09,23.05.15
Circulation function:


Attachments
Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading (2.11 KB, patch)
2024-08-15 22:50 UTC, Phil Ringnalda
Details | Diff | Splinter Review
Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading (2.16 KB, patch)
2024-08-16 01:03 UTC, David Cook
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Phil Ringnalda 2024-08-15 21:19:18 UTC
When you edit an existing record, the basic editor has an <h1> at the top of the page saying "Editing {bib title} (Record nnn)", which fails to HTML-escape the title. That gives you unpleasant results if the title is something like "<h2> is a second-level heading" making the entire editor an <h2>, or it gives you alarming results if someone has stuck a <script> in the title.

Steps to reproduce:

1. Edit any bib record, stick <script>alert('boo ❤')</script><h2> at the end of the title in field 245 subfield a
2. Save, then edit the bib record again.
3. Oops, that alert() could have been more serious.
Comment 1 Phil Ringnalda 2024-08-15 22:50:34 UTC
Created attachment 170414 [details] [review]
Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading

We stick the title of a bib record you are editing in the basic editor into
an <h1> without escaping any HTML it might contain. We should instead escape
it.

Test plan:

1. Without the patch, search for any record in the catalog and click Edit
   record (if you are in the advanced editor, switch to the basic one)
2. Tab 2, Field 245, Subfield a, paste <script>alert('boo ❤')</script><h2>
   at the end of the subfield
3. Save, then from the record detail page select Edit - Edit record
4. You will have gotten an alert(), and the entire form will be the size
   of an <h2>. That's ugly, so go back to the detail page.
5. Apply patch, restart_all
6. Edit - Edit record
7. Now you should not get an alert, the whole title inluding the <script>
   should display in italics, and the "(Record number nnn)" after it should
   not be italicized.
Comment 2 David Cook 2024-08-16 01:03:57 UTC
Created attachment 170415 [details] [review]
Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading

We stick the title of a bib record you are editing in the basic editor into
an <h1> without escaping any HTML it might contain. We should instead escape
it.

Test plan:

1. Without the patch, search for any record in the catalog and click Edit
   record (if you are in the advanced editor, switch to the basic one)
2. Tab 2, Field 245, Subfield a, paste <script>alert('boo ❤')</script><h2>
   at the end of the subfield
3. Save, then from the record detail page select Edit - Edit record
4. You will have gotten an alert(), and the entire form will be the size
   of an <h2>. That's ugly, so go back to the detail page.
5. Apply patch, restart_all
6. Edit - Edit record
7. Now you should not get an alert, the whole title inluding the <script>
   should display in italics, and the "(Record number nnn)" after it should
   not be italicized.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 3 David Cook 2024-08-16 01:04:53 UTC
Excellent work here, Phil. Simple yet effective fix.

Pushing this straight through to QA since it's such a small change.
Comment 4 Wainui Witika-Park 2024-09-11 05:03:59 UTC
Applied to 23.05.x-security
Comment 6 Fridolin Somers 2024-10-01 13:14:08 UTC
Backported to 23.11.x-security
Comment 7 Lucas Gass (lukeg) 2024-10-09 14:32:25 UTC
Backported to 24.05.x for 24.05.04
Comment 8 Katrin Fischer 2024-10-18 09:24:37 UTC
(In reply to Fridolin Somers from comment #6)
> Backported to 23.11.x-security

Please update the versions field as well!
Comment 9 Katrin Fischer 2024-10-18 10:17:21 UTC
Pushed for 24.11!

Well done everyone, thank you!
Comment 10 Jesse Maseto 2025-03-31 09:51:15 UTC
Pushed to 22.11.x. Will be in next point release. 22.11.25