Bugzilla – Attachment 155637 Details for
Bug 34761
Stored/reflected XSS with searches and saved search filters
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34761: Prevent XSS for searches and saved search filters
Bug-34761-Prevent-XSS-for-searches-and-saved-searc.patch (text/plain), 3.87 KB, created by
Marcel de Rooy
on 2023-09-15 06:43:13 UTC
(
hide
)
Description:
Bug 34761: Prevent XSS for searches and saved search filters
Filename:
MIME Type:
Creator:
Marcel de Rooy
Created:
2023-09-15 06:43:13 UTC
Size:
3.87 KB
patch
obsolete
>From 78572e4ff7d546a9e70c21bd4707a7a9695bf9da Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Wed, 13 Sep 2023 01:33:43 +0000 >Subject: [PATCH] Bug 34761: Prevent XSS for searches and saved search filters >Content-Type: text/plain; charset=utf-8 > ></script> tags are interpreted in JSON strings as HTML, which can >lead to XSS attacks. > >This patch puts HTML escaped JSON in the value of a hidden HTML element. >The Javascript then takes the value as a string, parses it as JSON, >and is able to use it to save search filters without triggering a >XSS attack. > >This patch also adds DataTable's built-in HTML escaping for the query >and limits on the admin UI for the search filters. > >Test plan: >0. Apply patch >1. Go to >http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters >2. Enable the system preference >3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e >4. Click "Save search as filter" >5. Checkbox "Show in staff interface?" >6. Type "E-TEST" into box and click 'Save' >7. Go to >http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e >8. Click "E-TEST" under "Custom search filters" >9. Note that you see search results >10. Go to >http://localhost:8081/cgi-bin/koha/admin/search_filters.pl >11. Note that for "E-TEST" you see a "Query" like >{"operators":[],"operands":["e"],"indexes":[]} >12. Note that for "E-TEST" you see a "Limits" like >{"limits":[]} > >Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> > >Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> >--- > .../intranet-tmpl/prog/en/modules/admin/search_filters.tt | 6 ++++-- > .../intranet-tmpl/prog/en/modules/catalogue/results.tt | 6 ++++-- > 2 files changed, 8 insertions(+), 4 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/search_filters.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/search_filters.tt >index 0777c168cc..1ee1b51343 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/search_filters.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/search_filters.tt >@@ -119,12 +119,14 @@ > { > "data": "query", > "searchable": true, >- "orderable": true >+ "orderable": true, >+ "render": jQuery.fn.DataTable.render.text() > }, > { > "data": "limits", > "searchable": true, >- "orderable": true >+ "orderable": true, >+ "render": jQuery.fn.DataTable.render.text() > }, > { > "data": "opac", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >index 231eec76d3..41c790e58c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >@@ -777,6 +777,8 @@ > </div> <!-- /.col-sm-2.col-sm-pull-10 --> > </div> <!-- /.row --> > >+<input type="hidden" id="query_json" value="[% query_json | html %]"> >+<input type="hidden" id="limit_json" value="[% limit_json | html %]"> > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/browser.js") | $raw %] > [% Asset.js("lib/hc-sticky.js") | $raw %] >@@ -817,8 +819,8 @@ > query_desc: "[% To.json( query_desc ) | html %]", > query_cgi: "[% query_cgi | html %]", > limit_cgi: "[% limit_cgi | html %]", >- query_json: [% query_json | $raw %], >- limit_json: [% limit_json | $raw %], >+ query_json: JSON.parse($('#query_json').val()), >+ limit_json: JSON.parse($('#limit_json').val()), > sort_by: "[% sort_by | html %]", > gotoPage: "[% gotoPage | html %]", > gotoNumber: "[% gotoNumber | html %]", >-- >2.30.2
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34761
:
155527
|
155528
|
155581
|
155598
| 155637