Attachment 170525 Details for Bug 37681 – Bug 37681: Fix XSS in staff interface item URLs on detail page

[patch] Bug 37681: Fix XSS in staff interface item URLs on detail page

Bug-37681-Fix-XSS-in-staff-interface-item-URLs-on-.patch (text/plain), 2.80 KB, created by Martin Renvoize (ashimema) on 2024-08-21 07:35:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2024-08-21 07:35:44 UTC

Size: 2.80 KB

patch

obsolete

>From 55f7cf1a49cefe8cc1cfc2a04a4916e7681260c4 Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Tue, 20 Aug 2024 00:54:38 +0000
>Subject: [PATCH] Bug 37681: Fix XSS in staff interface item URLs on detail
> page
>
>This patch uses Javascript objects and safe sinks to prevent XSS
>in the item URLs on the staff interface detail page.
>
>It also makes sure those URLs don't get double-escaped. Yippee!
>
>Test plan:
>0. Apply the patch
>1. Add/edit an item with the following URL:
>http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au
>2. Add/edit a different item with the following URLs:
>http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au |
>http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au
>3. Go to the staff interface detail page
>4. Notice that the URLs are not double-encoded!
>5. Try out a malicious payload (talk to QA/security about this)
>6. Confirm that the malicious payload fails to execute the XSS
>7. Celebrate!
>
>Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>---
> .../tables/items/catalogue_detail.inc         | 19 +++++++++++++++++--
> 1 file changed, 17 insertions(+), 2 deletions(-)
>
>diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc
>index c1771d0cfb6..4c805218e56 100644
>--- a/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc
>+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc
>@@ -629,10 +629,12 @@
>                     let nodes = '';
>                     if ( row.uri.split(' \| ').length > 1 ) {
>                         row.uri.split(' \| ').forEach((uri, i) => {
>-                            nodes += '<a href="%s">%s</a><br/>'.format(escape_str(uri), escape_str(uri));
>+                            let node = safe_link(uri,uri);
>+                            nodes += node.outerHTML + "<br>";
>                         });
>                     } else {
>-                        nodes += '<a href="%s">%s</a><br/>'.format(escape_str(row.uri), escape_str(url_link_text));
>+                        let node = safe_link(row.uri,url_link_text);
>+                        nodes += node.outerHTML;
>                     }
>                     return nodes;
>                 }
>@@ -846,5 +848,18 @@
> 
>         return items_table;
>     }
>+    function safe_link(uri,link_text) {
>+        let node = document.createElement('a');
>+        let url_str = '#';
>+        try {
>+            const safe_url = new URL(uri);
>+            url_str = safe_url.href;
>+        } catch (e) {
>+            //console.error('Invalid URL:', e);
>+        }
>+        node.setAttribute('href',url_str);
>+        node.textContent = link_text;
>+        return node;
>+    }
> </script>
> [% END %]
>-- 
>2.46.0

Actions: View | Diff | Splinter Review

Attachments on bug 37681: 170486 | 170525 | 171117