Bugzilla – Attachment 171164 Details for
Bug 37861
Fix XSS vulnerability in barcode append function
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
Ignore
Ignore.patch (text/plain), 4.30 KB, created by
Artur
on 2024-09-07 16:18:43 UTC
(
hide
)
Description:
Ignore
Filename:
MIME Type:
Creator:
Artur
Created:
2024-09-07 16:18:43 UTC
Size:
4.30 KB
patch
obsolete
>From 28639022770195116b8938c93e3146f26ad69a52 Mon Sep 17 00:00:00 2001 >From: Centiljard <89267105+Centiljard@users.noreply.github.com> >Date: Sat, 7 Sep 2024 18:12:05 +0200 >Subject: [PATCH] Bug 37861: Fix XSS vulnerability in barcode append function > >When user inputs were appended directly to the barcode table, the values were not properly escaped, allowing potential XSS attacks. This patch ensures that user inputs are sanitized and safely added to the DOM using .text() and .attr() methods to prevent script injection. > >To test: >Enable the "SelfCheckInModule". >Open the barcode input form. >Enter a barcode with HTML or script tags. >Without the patch, observe that the script is executed. >Apply the patch. >Repeat step 2. >Verify that the input is escaped and no script execution occurs. >Check that the barcode is properly appended to the table. > >Documentation: >No updates required. > >Sponsored-by: >KillerRabbitAos >--- > .../bootstrap/en/modules/sci/sci-main.tt | 73 +++++++++++-------- > 1 file changed, 44 insertions(+), 29 deletions(-) > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt >index bc5d1affeb..3de3ac94ee 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt >@@ -226,37 +226,52 @@ > }); > > $(document).ready(function() { >- // Barcodes scanning table initially hidden >- $("#sci_barcodes_table").hide(); >- // Control de 'append' button behaviour >- $("#sci_append_button").on('click',function( e ){ >- // Make sure the form is not submitted by the button >- e.preventDefault(); >- var barcode = $('#barcode_input').val(); >- //var result = validate_barcode( barcode ); >- $('#sci_barcodes_table tbody').append( >- '<tr style="font-size: initial;"><td>' + >- barcode + >- '<input type="hidden" name="barcode" value="' + barcode + '" />' + >- '</td></tr>' ); >- // Make sure the table is now displayed >- $("#sci_barcodes_table").show(); >- $('#sci_checkin_button').show(); >- $('#sci_refresh_button').show(); >- barcodes.push(barcode); >- // clean the input, reset the focus >- $('#barcode_input').val(''); >- dofocus(); >- }); >+ // Barcodes scanning table initially hidden >+ $("#sci_barcodes_table").hide(); >+ >+ // Control the 'append' button behaviour >+ $("#sci_append_button").on('click', function(e) { >+ // Make sure the form is not submitted by the button >+ e.preventDefault(); >+ >+ var barcode = $('#barcode_input').val().trim(); // Trim whitespace from input >+ >+ if (barcode !== "") { >+ // Properly escape the barcode value by using .text() for display >+ var barcodeHtml = $('<tr style="font-size: initial;"><td></td></tr>'); >+ barcodeHtml.find('td').text(barcode).append( >+ $('<input>').attr({ >+ type: 'hidden', >+ name: 'barcode', >+ value: barcode >+ }) >+ ); >+ >+ $('#sci_barcodes_table tbody').append(barcodeHtml); >+ >+ // Make sure the table is now displayed >+ $("#sci_barcodes_table").show(); >+ $('#sci_checkin_button').show(); >+ $('#sci_refresh_button').show(); >+ >+ // Add barcode to the array >+ barcodes.push(barcode); >+ } >+ >+ // Clear the input and reset the focus >+ $('#barcode_input').val(''); >+ dofocus(); >+ }); > >- $(".helpModal-trigger").on("click",function(e){ >- e.preventDefault(); >- $("#helpModal").modal("show"); >- }); >+ $(".helpModal-trigger").on("click", function(e) { >+ e.preventDefault(); >+ $("#helpModal").modal("show"); >+ }); >+ >+ // Set focus at the beginning >+ dofocus(); >+}); > >- // set focus at the beginning >- dofocus(); >- }); > > var idleTime = 0; > $(document).ready(function () { >-- >2.44.0 >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 37861
:
171164
|
171165
|
171279
|
172931
|
174312