From d102bb78ffdfb4b17b7e152871d09cb4fdc4412a Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 30 Jul 2020 13:59:46 +0200
Subject: [PATCH] Bug 26102: Prevent XSS when To.json is used

---
 .../prog/en/includes/js_includes.inc          |  2 +-
 .../prog/en/modules/admin/preferences.tt      |  2 +-
 .../en/modules/authorities/authorities.tt     |  2 +-
 .../authorities/blinddetail-biblio-search.tt  |  4 +--
 .../prog/en/modules/catalogue/itemsearch.tt   |  2 +-
 .../prog/en/modules/catalogue/results.tt      |  2 +-
 .../value_builder/unimarc_field_4XX.tt        | 34 +++++++++----------
 .../prog/en/modules/members/memberentrygen.tt |  2 +-
 .../members/tables/guarantor_search.tt        |  2 +-
 .../prog/en/modules/reserve/request.tt        |  4 +--
 .../en/modules/serials/subscription-add.tt    |  2 +-
 .../suggestion/tables/suggester_search.tt     |  2 +-
 .../bootstrap/en/modules/sco/sco-main.tt      |  2 +-
 13 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc
index f56faebea8..687e84a47b 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc
+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc
@@ -66,7 +66,7 @@
     <script>
         // AudioAlerts
         var AUDIO_ALERT_PATH = '[% interface | html %]/[% theme | html %]/sound/';
-        var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | $raw %]" );
+        var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | html %]" );
 
         $( document ).ready(function() {
             if ( AUDIO_ALERTS ) {
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt
index 4ec818f470..8723c709be 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt
@@ -249,7 +249,7 @@
             });
         });
         // This is here because of its dependence on template variables, everything else should go in js/pages/preferences.js - jpw
-        var to_highlight = "[% To.json( searchfield ) | $raw %]";
+        var to_highlight = "[% To.json( searchfield ) | html %]";
         var search_jumped = [% IF ( search_jumped ) %]true[% ELSE %]false[% END %];
         var MSG_NOTHING_TO_SAVE = _("Nothing to save");
         var MSG_SAVING = _("Saving...");
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
index 026f48560f..82a0dc42a1 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt
@@ -70,7 +70,7 @@ function AreMandatoriesNotOk(){
     		[% FOREACH subfield_loo IN innerloo.subfield_loop %]
     			[% IF ( subfield_loo.mandatory ) %]mandatories.push("[% subfield_loo.id | html %]");
                     tab.push("[% BIG_LOO.number | html %]");
-                    label.push("[% To.json(subfield_loo.marc_lib) | $raw %]");
+                    label.push("[% To.json(subfield_loo.marc_lib) | html %]");
     			[% END %]
 			[% END %]
 		[% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt
index 083eda7c18..776883c340 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt
@@ -32,9 +32,9 @@
                 [% ELSE %]
                 var new_line = "
                 [%- FOREACH SUBFIELD_LOO IN SUBFIELD_LOOP -%]‡
-                    [%- To.json( SUBFIELD_LOO.marc_subfield ) | $raw -%]
+                    [%- To.json( SUBFIELD_LOO.marc_subfield ) | html -%]
                     [%- FOREACH marc_value IN SUBFIELD_LOO.marc_values -%]
-                        [%- To.json( marc_value ) | $raw -%]
+                        [%- To.json( marc_value ) | html -%]
                     [%- END -%]
                 [%- END -%]‡9[% authid | html %]";
                 [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
index b1fa37e812..1ce4e9ddee 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt
@@ -108,7 +108,7 @@
         [%- label = BLOCK %][% e.label | html %][% END -%]
         [%- escaped.push({ 'value' => value, 'label' => label }) -%]
     [%- END -%]
-    [%- To.json(escaped) | $raw -%]
+    [%- To.json(escaped) | html -%]
 [%- END -%]
 
 [% notforloans = AuthorisedValues.GetDescriptionsByKohaField({ kohafield = 'items.notforloan' }) %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
index 220d7de5ea..92ae625dff 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt
@@ -736,7 +736,7 @@
         [%- END -%]
 
         var search_result = {
-            query_desc: "[% To.json( query_desc ) | $raw %]",
+            query_desc: "[% To.json( query_desc ) | html %]",
             query_cgi: "[% query_cgi | html %]",
             limit_cgi: "[% limit_cgi | html %]",
             sort_cgi: "[% sort_cgi | html %]",
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
index 35bad25966..4edfbace20 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt
@@ -169,55 +169,55 @@
                         var subfield = subfields[i+1];
 
                         if(code.value == '9'){
-                                subfield.value = "[% To.json( subfield_value_9 ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_9 ) | html %]";
                         }
                         if(code.value == '0'){
-                                subfield.value = "[% To.json( subfield_value_0 ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_0 ) | html %]";
                         }
                         if(code.value == 'a'){
-                                subfield.value = "[% To.json( subfield_value_a ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_a ) | html %]";
                         }
                         if(code.value == 'c'){
-                                subfield.value = "[% To.json( subfield_value_c ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_c ) | html %]";
                         }
                         if(code.value == 'd'){
-                                subfield.value = "[% To.json( subfield_value_d ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_d ) | html %]";
                         }
                         if(code.value == 'e'){
-                                subfield.value = "[% To.json( subfield_value_e ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_e ) | html %]";
                         }
                         if(code.value == 'h'){
-                                subfield.value = "[% To.json( subfield_value_h ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_h ) | html %]";
                         }
                         if(code.value == 'i'){
-                                subfield.value = "[% To.json( subfield_value_i ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_i ) | html %]";
                         }
                         if(code.value == 'l'){
-                                subfield.value = "[% To.json( subfield_value_l ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_l ) | html %]";
                         }
                         if(code.value == 'n'){
-                                subfield.value = "[% To.json( subfield_value_n ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_n ) | html %]";
                         }
                         if(code.value == 'o'){
-                                subfield.value = "[% To.json( subfield_value_o ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_o ) | html %]";
                         }
                         if(code.value == 'p'){
-                                subfield.value = "[% To.json( subfield_value_p ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_p ) | html %]";
                         }
                         if(code.value == 't'){
-                                subfield.value = "[% To.json( subfield_value_t ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_t ) | html %]";
                         }
                         if(code.value == 'u'){
-                                subfield.value = "[% To.json( subfield_value_u ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_u ) | html %]";
                         }
                         if(code.value == 'v'){
-                                subfield.value = "[% To.json( subfield_value_v ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_v ) | html %]";
                         }
                         if(code.value == 'x'){
-                                subfield.value = "[% To.json( subfield_value_x ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_x ) | html %]";
                         }
                         if(code.value == 'y'){
-                                subfield.value = "[% To.json( subfield_value_y ) | $raw %]";
+                                subfield.value = "[% To.json( subfield_value_y ) | html %]";
                         }
                     }
                 }
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
index 0014a0f612..c094bf5ade 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt
@@ -1592,7 +1592,7 @@ legend:hover {
 
             [% IF new_guarantors %]
                 [% FOREACH g IN new_guarantors %]
-                    select_user( '[% g.patron.borrowernumber | html %]', [% To.json( g.patron.unblessed ) | $raw %], '[% g.relationship | html %]' );
+                    select_user( '[% g.patron.borrowernumber | html %]', [% To.json( g.patron.unblessed ) | html %], '[% g.relationship | html %]' );
                 [% END %]
             [% END %]
 
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt
index 38ec5aa9e0..fd55506c11 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt
@@ -32,5 +32,5 @@
 [%~ IF data.zipcode %][% SET address = address _ data.zipcode _ ' ' %][% END %]
 [%~ IF data.country %][% SET address = address _ data.country _ ' ' %][% END %]
 [%~ SET address = address _ Branches.GetName( data.branchcode ) %]
-[%~ To.json( address ) | $raw ~%]
+[%~ address | html | $To ~%]
 [% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
index e15d468fcc..dcf16a92af 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt
@@ -939,10 +939,10 @@
         var biblionumber = "[% biblionumber | $raw %]";
         var borrowernumber = "[% patron.borrowernumber | $raw %]";
         var MSG_CONFIRM_DELETE_HOLD   = _("Are you sure you want to cancel this hold?");
-        var patron_homebranch = "[% To.json( Branches.GetName( patron.branchcode ) ) | $raw %]";
+        var patron_homebranch = "[% To.json( Branches.GetName( patron.branchcode ) ) | html %]";
         var override_items = {[% FOREACH bibitemloo IN bibitemloop %][% FOREACH itemloo IN bibitemloo.itemloop %][% IF ( itemloo.override ) %]
         [% itemloo.itemnumber | html %]: {
-            homebranch: "[% To.json( Branches.GetName( itemloo.homebranch ) ) | $raw %]";
+            homebranch: "[% To.json( Branches.GetName( itemloo.homebranch ) ) | html %]";
             holdallowed: [% itemloo.holdallowed | html %]
             },
             [% END %][% END %][% END %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
index 1075e14d19..8623f43a88 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt
@@ -556,7 +556,7 @@ fieldset.rows table { clear: none; margin: 0; }
         var MSG_MANA_NO_SUBSCRIPTION_FOUND = _("No subscription found on Mana Knowledge Base");
         var MSG_MANA_SHARE_PATTERN = _("Please feel free to share your pattern with all others librarians once you are done");
 
-        var BOOKSELLER_IDS = [% To.json( bookseller_ids ) || '[]' | $raw %];
+        var BOOKSELLER_IDS = [% To.json( bookseller_ids ) || '[]' | html %];
     </script>
     [% Asset.js("js/subscription-add.js") | $raw %]
     [% Asset.js("js/showpredictionpattern.js") | $raw %]
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt
index a82f0e8dcb..cbac0393a9 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt
@@ -32,5 +32,5 @@
 [%~ IF data.zipcode %][% SET address = address _ data.zipcode _ ' ' %][% END %]
 [%~ IF data.country %][% SET address = address _ data.country _ ' ' %][% END %]
 [%~ SET address = address _ Branches.GetName( data.branchcode ) %]
-[%~ To.json( address ) | $raw ~%]
+[%~ address | html | $To ~%]
 [% END %]
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
index c428886a4d..6d8622fd0c 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt
@@ -440,7 +440,7 @@
             return true;
         }
         [% IF Koha.Preference('AudioAlerts') %]
-            var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | $raw %]" );
+            var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | html %]" );
             $( document ).ready(function() {
                 if ( AUDIO_ALERTS ) {
                     for ( var k in AUDIO_ALERTS ) {
-- 
2.20.1