Attachment 95480 Details for Bug 23290 – Bug 23290: XSLT system preferences allow administrators to exploit XML and XSLT vulnerabilities

[patch] Bug 23290: XSLT system preferences allow administrators to exploit XML and XSLT vulnerabilities

Bug-23290-XSLT-system-preferences-allow-administra.patch (text/plain), 2.67 KB, created by Marcel de Rooy on 2019-11-18 10:30:51 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcel de Rooy

Created: 2019-11-18 10:30:51 UTC

Size: 2.67 KB

patch

obsolete

>From d6e0c8371a41ed00de46f83d0af9bada121a0c08 Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Thu, 23 May 2019 16:53:57 +1000
>Subject: [PATCH] Bug 23290: XSLT system preferences allow administrators to
> exploit XML and XSLT vulnerabilities
>Content-Type: text/plain; charset=utf-8
>
>The problem is that administrators can provide XSLTs that
>can read from the server and network and write to the server. The
>
>This patch prevents the Koha::XSLT_Handler from running
>XSLT stylesheets that call actions such as read_file, write_file,
>read_net, and write_net as documented at
>https://metacpan.org/pod/XML::LibXSLT#XML::LibXSLT::Security
>
>(Previous tests suggested issues with XML external entities
>causing read file like vulnerabilities but these were not
>reproducible)
>
>Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
>---
> Koha/XSLT_Handler.pm | 33 +++++++++++++++++++++++++++++++++
> 1 file changed, 33 insertions(+)
>
>diff --git a/Koha/XSLT_Handler.pm b/Koha/XSLT_Handler.pm
>index 0682c3ca20..55ce24c53f 100644
>--- a/Koha/XSLT_Handler.pm
>+++ b/Koha/XSLT_Handler.pm
>@@ -320,8 +320,41 @@ sub _load {
>         return;
>     }
> 
>+    my $security = XML::LibXSLT::Security->new();
>+    $security->register_callback( read_file  => sub {
>+        warn "read_file called in XML::LibXSLT";
>+        #i.e. when using the exsl:document() element or document() function (to read a XML file)
>+        my ($tctxt,$value) = @_;
>+        return 0;
>+    });
>+    $security->register_callback( write_file => sub {
>+        warn "write_file called in XML::LibXSLT";
>+        #i.e. when using the exsl:document element (or document() function?) (to write an output file of many possible types)
>+        #e.g.
>+        #<exsl:document href="file:///tmp/breached.txt">
>+        #   <xsl:text>breached!</xsl:text>
>+        #</exsl:document>
>+        my ($tctxt,$value) = @_;
>+        return 0;
>+    });
>+    $security->register_callback( read_net   => sub {
>+        warn "read_net called in XML::LibXSLT";
>+        #i.e. when using the document() function (to read XML from the network)
>+        #e.g. <xsl:copy-of select="document('http://localhost')" />
>+        my ($tctxt,$value) = @_;
>+        return 0;
>+    });
>+    $security->register_callback( write_net  => sub {
>+        warn "write_net called in XML::LibXSLT";
>+        #NOTE: it's unknown how one would invoke this, but covering our bases anyway
>+        my ($tctxt,$value) = @_;
>+        return 0;
>+    });
>+
>     #parse sheet
>     my $xslt = XML::LibXSLT->new;
>+    $xslt->security_callbacks( $security );
>+
>     $rv = $code? $digest.$codelen: $filename;
>     $self->{xslt_hash}->{$rv} = eval { $xslt->parse_stylesheet($style_doc) };
>     if ($@) {
>-- 
>2.11.0

Actions: View | Diff | Splinter Review

Attachments on bug 23290: 91435 | 91437 | 95450 | 95451 | 95452 | 95453 | 95454 | 95475 | 95478 | 95480 | 95481 | 95482 | 95483 | 95484 | 95485 | 95551 | 96299 | 96300 | 96301 | 96302 | 96303 | 96304 | 97606 | 97607 | 97608 | 97609 | 97610 | 97611 | 97612 | 97613 | 97614 | 97615 | 97616 | 97617 | 97618 | 97619 | 97620 | 97871 | 97978 | 97980 | 98397 | 98398 | 98399 | 98400 | 98401 | 98402 | 98403 | 98404 | 98405 | 98406 | 99587