Bugzilla – Attachment 179676 Details for
Bug 38969
Reflected XSS vulnerability in tags
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38969: [alternate] Prevent self-XSS when testing tags in staff interface
Bug-38969-alternate-Prevent-self-XSS-when-testing-.patch (text/plain), 2.62 KB, created by
David Cook
on 2025-03-25 00:56:21 UTC
(
hide
)
Description:
Bug 38969: [alternate] Prevent self-XSS when testing tags in staff interface
Filename:
MIME Type:
Creator:
David Cook
Created:
2025-03-25 00:56:21 UTC
Size:
2.62 KB
patch
obsolete
>From 9e4de6dc600ad23747d6354020d9427707434f0e Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Tue, 25 Mar 2025 00:40:26 +0000 >Subject: [PATCH] Bug 38969: [alternate] Prevent self-XSS when testing tags in > staff interface >MIME-Version: 1.0 >Content-Type: text/plain; charset=UTF-8 >Content-Transfer-Encoding: 8bit > >This change refactors the tag test in the staff interface to >use more standard Javascript/JSON for passing messages >and writing HTML. > >Test plan: >- Apply the patch and koha-plack --restart kohadev >- Go to Admin > Tools > Tags >- Paste "<script> alert("ä¸å¥½! XSS FOUND!") </script>" into the input field under the "Check lists" heading >- Click on "Test" >- Note that the following test appears below the Test button: ><script> alert("ä¸å¥½! XSS FOUND!") </script> is neither permitted nor prohibited! >--- > koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js | 6 +++--- > tags/review.pl | 5 +++-- > 2 files changed, 6 insertions(+), 5 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js b/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js >index 67b68b7dec..20c956a888 100644 >--- a/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js >+++ b/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js >@@ -59,10 +59,10 @@ var failure_test = function (tag) { > $("#verdict").html(__("%s is prohibited!").format(decodeURIComponent(tag))); > }; > var indeterminate_test = function (tag) { >+ const span = document.createElement("span"); >+ span.textContent = tag; > $("#verdict").html( >- __("%s is neither permitted nor prohibited!").format( >- decodeURIComponent(tag) >- ) >+ __("%s is neither permitted nor prohibited!").format(span.innerHTML) > ); > }; > >diff --git a/tags/review.pl b/tags/review.pl >index 82b82ace28..ed1523116d 100755 >--- a/tags/review.pl >+++ b/tags/review.pl >@@ -34,6 +34,7 @@ use C4::Tags qw( > is_approved > whitelist > ); >+use JSON; > > my $script_name = "/cgi-bin/koha/tags/review.pl"; > my $needed_flags = { tools => 'moderate_tags' }; # FIXME: replace when more specific permission is created. >@@ -63,8 +64,8 @@ if ( is_ajax() ) { > my $check = is_approved($tag); > $js_reply = > ( $check >= 1 ? 'success' : $check <= -1 ? 'failure' : 'indeterminate' ) >- . "_test('" >- . uri_escape_utf8($tag) . "');\n"; >+ . "_test(" >+ . JSON::encode_json($tag) . ");\n"; > } elsif ( $op eq 'cud-approve' ) { > $js_reply = > ( whitelist( $operator, $tag ) ? 'success' : 'failure' ) . "_approve('" . uri_escape_utf8($tag) . "');\n"; >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38969
:
177148
|
177159
|
177160
|
179553
|
179554
|
179676
|
179708
|
179709
|
179710
|
181329
|
181330
|
181331
|
181332
|
181464