Attachment 169541 Details for Bug 37464 – Bug 37464: Validate "type" sent to barcode/svc

[patch] Bug 37464: Validate "type" sent to barcode/svc

Bug-37464-Validate-type-sent-to-barcodesvc.patch (text/plain), 2.66 KB, created by David Cook on 2024-07-25 07:06:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Cook

Created: 2024-07-25 07:06:47 UTC

Size: 2.66 KB

patch

obsolete

>From 9c02e73bfbe376752b090489d3e052503484408d Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Thu, 25 Jul 2024 06:56:18 +0000
>Subject: [PATCH] Bug 37464: Validate "type" sent to barcode/svc
>
>This change validates the "type" sent to the barcode/svc. Without this
>change, we pass the user input directly to GD::Barcode, which passes
>the input into an eval{} block without any validation of its own.
>
>Test plan:
>0. Apply the patch
>1. koha-plack --reload kohadev
>2. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=bad&barcode=123456
>3. Note that a Code39 barcode is provided for an invalid type
>4. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=Code39&barcode=123456
>5. Note that a Code39 barcode is provided
>6. Go to http://localhost:8081/cgi-bin/koha/svc/barcode?type=UPCE&barcode=123456
>7. Note that a non-Code39 barcode is provided (presumably UPCE)
>---
> svc/barcode | 23 ++++++++++++++++++++++-
> 1 file changed, 22 insertions(+), 1 deletion(-)
>
>diff --git a/svc/barcode b/svc/barcode
>index df6be31404..e54e6e6d17 100755
>--- a/svc/barcode
>+++ b/svc/barcode
>@@ -89,6 +89,21 @@ below the scannable barcode.
> 
> =cut
> 
>+my %type_mapping = (
>+    Code39         => 1,
>+    UPCE           => 1,
>+    UPCA           => 1,
>+    QRcode         => 1,
>+    NW7            => 1,
>+    Matrix2of5     => 1,
>+    ITF            => 1,
>+    Industrial2of5 => 1,
>+    IATA2of5       => 1,
>+    EAN8           => 1,
>+    EAN13          => 1,
>+    COOP2of5       => 1,
>+);
>+
> my $input = CGI->new;
> 
> my ( $auth_status ) = check_cookie_auth( $input->cookie('CGISESSID'), { catalogue => '*' } );
>@@ -99,13 +114,18 @@ if ( $auth_status ne "ok" ) {
> 
> binmode(STDOUT);
> 
>-my $type = $input->param('type') || 'Code39';
>+my $type = $input->param('type') || '';
> my $barcode = $input->param('barcode');
> my $notext = $input->param('notext') ? 1 : 0;
> my $height = $input->param('height') || 50;
> my $qrcode_modulesize = $input->param('modulesize') || "5"; # 1+
> my $image;
> 
>+# Validate the barcode type. Default to Code39 if no type or unsupported type sent.
>+if ( !$type_mapping{$type} ) {
>+    $type = 'Code39';
>+}
>+
> if ( $type eq 'Code39' ) {
>     $barcode = '*' . $barcode unless $barcode =~ /^\*/;
>     $barcode = $barcode . '*' unless $barcode =~ /\*$/;
>@@ -115,6 +135,7 @@ eval {
>     if( $type eq "QRcode" ){
>         $image = GD::Barcode->new('QRcode', $barcode, { Ecc => "M", ModuleSize => $qrcode_modulesize } )->plot->png();
>     } else {
>+        # BZ 37464 - $type must be validated as GD::Barcode unsafely passes this argument directly to an eval{} block
>         $image = GD::Barcode->new( $type, $barcode )->plot( NoText => $notext, Height => $height )->png();
>     }
> };
>-- 
>2.39.2

Actions: View | Diff | Splinter Review

Attachments on bug 37464: 169537 | 169541 | 169800 | 169801