Attachment 170518 Details for Bug 37656 – Bug 37656: XSS in Advanced editor from Z39.50 search results

[patch] Bug 37656: XSS in Advanced editor from Z39.50 search results

Bug-37656-XSS-in-Advanced-editor-from-Z3950-search.patch (text/plain), 2.75 KB, created by David Cook on 2024-08-21 05:29:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Cook

Created: 2024-08-21 05:29:47 UTC

Size: 2.75 KB

patch

obsolete

>From a8ef14407ddb2f04c79702a1e3ebe7c87399f4bb Mon Sep 17 00:00:00 2001
>From: Phil Ringnalda <phil@chetcolibrary.org>
>Date: Thu, 15 Aug 2024 21:22:12 -0700
>Subject: [PATCH] Bug 37656: XSS in Advanced editor from Z39.50 search results
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>The Advanced editor inserts data from Z39.50 results into the search results
>page without escaping HTML. Whether it's German records with "<<A>> Title"
>or someone with a compromised catalog or a book with the title "<em> for
>emphasis" it shouldn't.
>
>Test plan:
> 1. Not a dependency, but you'll avoid getting even more alerts while batch
>    importing by starting with the patch from bug 37654
> 2. Without this patch applied, download attachment 170421
> 3. Administration - set the preference EnableAdvancedCatalogingEditor to
>    Enable
> 4. Cataloging - Stage records for import - browse to the downloaded file -
>    Upload file - Stage for import
> 5. Once the background job finishes, View batch (getting alerts if you
>    didn't apply the patch from bug 37654) - Import this batch into the
>    catalog
> 6. When the import finishes, Search the catalog for script, on the imported
>    record Edit record (if you wind up in the basic editor, Settings - Switch
>    to Advanced editor)
> 7. In the left sidebar below the search inputs, click Advanced Â», check
>    the checkbox for Local catalog and uncheck any others, then search for
>    the Title script
> 8. You'll get five alerts, and the word "edition" displayed in huge text
> 9. Close the search popup, apply patch, shift+reload the advanced editor
>    page to clear your cache
>10. Repeat step 7, but this time you won't get any alerts, and you'll see
>    the title and the other <script> inclusions.
>
>Sponsored-by: Chetco Community Public Library
>Signed-off-by: David Cook <dcook@prosentient.com.au>
>---
> koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc
>index c767a21212..338c7d5dee 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc
>@@ -557,7 +557,7 @@ require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'pr
>                 if ( !seenColumns[ label[0] ] ) return;
> 
>                 if ( hit.metadata[ label[0] ] ) {
>-                    result += '<td class="infocol">' + hit.metadata[ label[0] ] + '</td>';
>+                    result += '<td class="infocol">' + escape_str(hit.metadata[ label[0] ]) + '</td>';
>                 } else {
>                     result += '<td class="infocol">&nbsp;</td>';
>                 }
>-- 
>2.39.2

Actions: View | Diff | Splinter Review

Attachments on bug 37656: 170421 | 170456 | 170518 | 170523