Bugzilla – Attachment 118363 Details for
Bug 27942
QOTD: quote CSV uploads may contain JavaScript payloads (XSS)
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 27942: Prevent XSS vulnerabilities in quote-upload
Bug-27942-Prevent-XSS-vulnerabilities-in-quote-upl.patch (text/plain), 2.62 KB, created by
Jonathan Druart
on 2021-03-17 10:42:18 UTC
(
hide
)
Description:
Bug 27942: Prevent XSS vulnerabilities in quote-upload
Filename:
MIME Type:
Creator:
Jonathan Druart
Created:
2021-03-17 10:42:18 UTC
Size:
2.62 KB
patch
obsolete
>From 6032d1f5c54ae6111088a92e58e8c9ca332689bc Mon Sep 17 00:00:00 2001 >From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> >Date: Wed, 17 Mar 2021 11:38:47 +0100 >Subject: [PATCH] Bug 27942: Prevent XSS vulnerabilities in quote-upload >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >When uploading new quotes the JS variables are not escaped correctly. > >Test plan: >Create a new file with the following content (remove the first and last lines containing """): >""" >":this is a source","this is a text" >"this is another â¤one","and another textâ¤" >"this <script>alert('foo');</script>","and <script>alert('â¤');</script>" >""" > >Go to Home ⺠Tools ⺠Quote editor >Click Import quote >Select the file >Edit the third line, hit enter >Import quotes >--- > .../intranet-tmpl/prog/en/modules/tools/quotes-upload.tt | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt >index 867a3628c3..c9961bc2fb 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt >@@ -157,6 +157,8 @@ > // then default to comma. > strDelimiter = (strDelimiter || ","); > >+ strData = escape_str(strData); >+ > // Create a regular expression to parse the CSV values. > var objPattern = new RegExp( > ( >@@ -280,6 +282,7 @@ > "fnDrawCallback": function(oSettings) { > /* Apply the jEditable handlers to the table on all fields w/o the no_edit id */ > $('#quotes_editor tbody td[id!="no_edit"]').editable( function(value, settings) { >+ value = escape_str(value); > var cellPosition = oTable.fnGetPosition( this ); > oTable.fnUpdate(value, cellPosition[0], cellPosition[1], false, false); > return(value); >@@ -346,7 +349,9 @@ > function fnGetData(element) { > var lines = oTable.fnGetData(); > $(lines).each(function(line){ >- var data = {source: this[1], text: this[2]}; >+ var s = this[1].replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>'); >+ var t = this[2].replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>'); >+ var data = {source: s, text: t}; > var success = 0; var error = 0; > $.ajax({ > url : "/api/v1/quotes", >-- >2.20.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 27942
:
118363
|
118867
|
119043
|
120429
|
120482
|
120726
|
120727