| 
      
            Line 0
          
      
      
        Link Here
      
     | 
  
          
            
              | 0 | 
              -   | 
              1 | 
              #!/usr/bin/env perl  | 
            
            
               | 
               | 
              2 | 
               | 
            
            
              | 3 | 
              # This file is part of Koha.  | 
            
            
              | 4 | 
              #  | 
            
            
              | 5 | 
              # Koha is free software; you can redistribute it and/or modify it  | 
            
            
              | 6 | 
              # under the terms of the GNU General Public License as published by  | 
            
            
              | 7 | 
              # the Free Software Foundation; either version 3 of the License, or  | 
            
            
              | 8 | 
              # (at your option) any later version.  | 
            
            
              | 9 | 
              #  | 
            
            
              | 10 | 
              # Koha is distributed in the hope that it will be useful, but  | 
            
            
              | 11 | 
              # WITHOUT ANY WARRANTY; without even the implied warranty of  | 
            
            
              | 12 | 
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the  | 
            
            
              | 13 | 
              # GNU General Public License for more details.  | 
            
            
              | 14 | 
              #  | 
            
            
              | 15 | 
              # You should have received a copy of the GNU General Public License  | 
            
            
              | 16 | 
              # along with Koha; if not, see <http://www.gnu.org/licenses>.  | 
            
            
              | 17 | 
               | 
            
            
              | 18 | 
              use Modern::Perl;  | 
            
            
              | 19 | 
               | 
            
            
              | 20 | 
              use Test::More tests => 1;  | 
            
            
              | 21 | 
              use Test::Mojo;  | 
            
            
              | 22 | 
              use t::lib::TestBuilder;  | 
            
            
              | 23 | 
              use t::lib::Mocks;  | 
            
            
              | 24 | 
               | 
            
            
              | 25 | 
              use C4::Context;  | 
            
            
              | 26 | 
              use C4::Biblio;  | 
            
            
              | 27 | 
               | 
            
            
              | 28 | 
              use Koha::Database;  | 
            
            
              | 29 | 
               | 
            
            
              | 30 | 
              use MARC::Field;  | 
            
            
              | 31 | 
               | 
            
            
              | 32 | 
              my $intranet =  | 
            
            
              | 33 | 
                $ENV{KOHA_INTRANET_URL} || C4::Context->preference("staffClientBaseURL"); | 
            
            
              | 34 | 
              my $opac = $ENV{KOHA_OPAC_URL} || C4::Context->preference("OPACBaseURL"); | 
            
            
              | 35 | 
               | 
            
            
              | 36 | 
              my $t       = Test::Mojo->new();  | 
            
            
              | 37 | 
              my $schema  = Koha::Database->new->schema;  | 
            
            
              | 38 | 
              my $builder = t::lib::TestBuilder->new;  | 
            
            
              | 39 | 
               | 
            
            
              | 40 | 
              subtest 'open redirection vulnerabilities in tracklinks' => sub { | 
            
            
              | 41 | 
                  plan tests => 30;  | 
            
            
              | 42 | 
               | 
            
            
              | 43 | 
                  $schema->storage->txn_begin;  | 
            
            
              | 44 | 
               | 
            
            
              | 45 | 
                  # No URI's  | 
            
            
              | 46 | 
                  my $biblio        = $builder->build_sample_biblio();  | 
            
            
              | 47 | 
                  my $biblionumber1 = $biblio->biblionumber;  | 
            
            
              | 48 | 
               | 
            
            
              | 49 | 
                  # Incorrect URI at Biblio level  | 
            
            
              | 50 | 
                  $biblio = $builder->build_sample_biblio();  | 
            
            
              | 51 | 
                  my $biblionumber2 = $biblio->biblionumber;  | 
            
            
              | 52 | 
                  my $record = $biblio->metadata->record;  | 
            
            
              | 53 | 
                  my $new856 = MARC::Field->new( '856', '', '', u => "www.bing.com" );  | 
            
            
              | 54 | 
                  $record->insert_fields_ordered($new856);  | 
            
            
              | 55 | 
                  C4::Biblio::ModBiblio( $record, $biblionumber2 );  | 
            
            
              | 56 | 
               | 
            
            
              | 57 | 
                  # URI at Biblio level  | 
            
            
              | 58 | 
                  $biblio = $builder->build_sample_biblio();  | 
            
            
              | 59 | 
                  my $biblionumber3 = $biblio->biblionumber;  | 
            
            
              | 60 | 
                  $record        = $biblio->metadata->record;  | 
            
            
              | 61 | 
                  $new856 = MARC::Field->new( '856', '', '', u => "www.google.com" );  | 
            
            
              | 62 | 
                  $record->insert_fields_ordered($new856);  | 
            
            
              | 63 | 
                  C4::Biblio::ModBiblio( $record, $biblionumber3 );  | 
            
            
              | 64 | 
               | 
            
            
              | 65 | 
                  # URI at Item level  | 
            
            
              | 66 | 
                  my $item = $builder->build_sample_item( { uri => 'www.google.com' } ); | 
            
            
              | 67 | 
                  my $itemnumber1 = $item->itemnumber;  | 
            
            
              | 68 | 
               | 
            
            
              | 69 | 
                  # Incorrect URI at Item level  | 
            
            
              | 70 | 
                  $item = $builder->build_sample_item( { uri => 'www.bing.com ' } ); | 
            
            
              | 71 | 
                  my $itemnumber2 = $item->itemnumber;  | 
            
            
              | 72 | 
               | 
            
            
              | 73 | 
                  my $no_biblionumber =  | 
            
            
              | 74 | 
                    '/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com';  | 
            
            
              | 75 | 
                  my $bad_biblionumber1 =  | 
            
            
              | 76 | 
                    '/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber='  | 
            
            
              | 77 | 
                    . $biblionumber1;  | 
            
            
              | 78 | 
                  my $bad_biblionumber2 =  | 
            
            
              | 79 | 
                    '/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber='  | 
            
            
              | 80 | 
                    . $biblionumber2;  | 
            
            
              | 81 | 
                  my $good_biblionumber =  | 
            
            
              | 82 | 
                    '/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&biblionumber='  | 
            
            
              | 83 | 
                    . $biblionumber3;  | 
            
            
              | 84 | 
                  my $bad_itemnumber =  | 
            
            
              | 85 | 
                    '/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&itemnumber='  | 
            
            
              | 86 | 
                    . $itemnumber2;  | 
            
            
              | 87 | 
                  my $good_itemnumber =  | 
            
            
              | 88 | 
                    '/cgi-bin/koha/tracklinks.pl?uri=http://www.google.com&itemnumber='  | 
            
            
              | 89 | 
                    . $itemnumber1;  | 
            
            
              | 90 | 
               | 
            
            
              | 91 | 
                  # Don't Track  | 
            
            
              | 92 | 
                  t::lib::Mocks::mock_preference( 'TrackClicks', '' );  | 
            
            
              | 93 | 
                  $t->get_ok( $opac . $no_biblionumber )  | 
            
            
              | 94 | 
                    ->status_is( 404, "404 for no biblionumber" );  | 
            
            
              | 95 | 
                  $t->get_ok( $opac . $bad_biblionumber1 )  | 
            
            
              | 96 | 
                    ->status_is( 404, "404 for biblionumber containing no URI" );  | 
            
            
              | 97 | 
                  $t->get_ok( $opac . $bad_biblionumber2 )  | 
            
            
              | 98 | 
                    ->status_is( 404, "404 for biblionumber containing different URI" );  | 
            
            
              | 99 | 
                  $t->get_ok( $opac . $good_biblionumber )  | 
            
            
              | 100 | 
                    ->status_is( 302, "302 for biblionumber with matching URI" );  | 
            
            
              | 101 | 
                  $t->get_ok( $opac . $bad_itemnumber )  | 
            
            
              | 102 | 
                    ->status_is( 404, "404 for itemnumber containing different URI" );  | 
            
            
              | 103 | 
                  $t->get_ok( $opac . $good_itemnumber )  | 
            
            
              | 104 | 
                    ->status_is( 302, "302 for itemnumber with matching URI" );  | 
            
            
              | 105 | 
               | 
            
            
              | 106 | 
                  # Track  | 
            
            
              | 107 | 
                  t::lib::Mocks::mock_preference( 'TrackClicks', 'track' );  | 
            
            
              | 108 | 
                  $t->get_ok( $opac . $no_biblionumber )  | 
            
            
              | 109 | 
                    ->status_is( 404, "404 for no biblionumber" );  | 
            
            
              | 110 | 
                  $t->get_ok( $opac . $bad_biblionumber1 )  | 
            
            
              | 111 | 
                    ->status_is( 404, "404 for biblionumber containing no URI" );  | 
            
            
              | 112 | 
                  $t->get_ok( $opac . $bad_biblionumber2 )  | 
            
            
              | 113 | 
                    ->status_is( 404, "404 for biblionumber containing different URI" );  | 
            
            
              | 114 | 
                  $t->get_ok( $opac . $good_biblionumber )  | 
            
            
              | 115 | 
                    ->status_is( 302, "302 for biblionumber with matching URI" );  | 
            
            
              | 116 | 
                  $t->get_ok( $opac . $bad_itemnumber )  | 
            
            
              | 117 | 
                    ->status_is( 404, "404 for itemnumber containing different URI" );  | 
            
            
              | 118 | 
                  $t->get_ok( $opac . $good_itemnumber )  | 
            
            
              | 119 | 
                    ->status_is( 302, "302 for itemnumber with matching URI" );  | 
            
            
              | 120 | 
               | 
            
            
              | 121 | 
                  # Track Anonymous  | 
            
            
              | 122 | 
                  t::lib::Mocks::mock_preference( 'TrackClicks', 'anonymous' );  | 
            
            
              | 123 | 
                  $t->get_ok( $opac . $no_biblionumber )  | 
            
            
              | 124 | 
                    ->status_is( 404, "404 for no biblionumber" );  | 
            
            
              | 125 | 
                  $t->get_ok( $opac . $bad_biblionumber1 )  | 
            
            
              | 126 | 
                    ->status_is( 404, "404 for biblionumber containing no URI" );  | 
            
            
              | 127 | 
                  $t->get_ok( $opac . $bad_biblionumber2 )  | 
            
            
              | 128 | 
                    ->status_is( 404, "404 for biblionumber containing different URI" );  | 
            
            
              | 129 | 
                  $t->get_ok( $opac . $good_biblionumber )  | 
            
            
              | 130 | 
                    ->status_is( 302, "302 for biblionumber with matching URI" );  | 
            
            
              | 131 | 
                  $t->get_ok( $opac . $bad_itemnumber )  | 
            
            
              | 132 | 
                    ->status_is( 404, "404 for itemnumber containing different URI" );  | 
            
            
              | 133 | 
                  $t->get_ok( $opac . $good_itemnumber )  | 
            
            
              | 134 | 
                    ->status_is( 302, "302 for itemnumber with matching URI" );  | 
            
            
              | 135 | 
               | 
            
            
              | 136 | 
                  $schema->storage->txn_rollback;  | 
            
            
              | 137 | 
              };  |