From d102bb78ffdfb4b17b7e152871d09cb4fdc4412a Mon Sep 17 00:00:00 2001 From: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Date: Thu, 30 Jul 2020 13:59:46 +0200 Subject: [PATCH] Bug 26102: Prevent XSS when To.json is used --- .../prog/en/includes/js_includes.inc | 2 +- .../prog/en/modules/admin/preferences.tt | 2 +- .../en/modules/authorities/authorities.tt | 2 +- .../authorities/blinddetail-biblio-search.tt | 4 +-- .../prog/en/modules/catalogue/itemsearch.tt | 2 +- .../prog/en/modules/catalogue/results.tt | 2 +- .../value_builder/unimarc_field_4XX.tt | 34 +++++++++---------- .../prog/en/modules/members/memberentrygen.tt | 2 +- .../members/tables/guarantor_search.tt | 2 +- .../prog/en/modules/reserve/request.tt | 4 +-- .../en/modules/serials/subscription-add.tt | 2 +- .../suggestion/tables/suggester_search.tt | 2 +- .../bootstrap/en/modules/sco/sco-main.tt | 2 +- 13 files changed, 31 insertions(+), 31 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc index f56faebea8..687e84a47b 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc +++ b/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc @@ -66,7 +66,7 @@ <script> // AudioAlerts var AUDIO_ALERT_PATH = '[% interface | html %]/[% theme | html %]/sound/'; - var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | $raw %]" ); + var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | html %]" ); $( document ).ready(function() { if ( AUDIO_ALERTS ) { diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt index 4ec818f470..8723c709be 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt @@ -249,7 +249,7 @@ }); }); // This is here because of its dependence on template variables, everything else should go in js/pages/preferences.js - jpw - var to_highlight = "[% To.json( searchfield ) | $raw %]"; + var to_highlight = "[% To.json( searchfield ) | html %]"; var search_jumped = [% IF ( search_jumped ) %]true[% ELSE %]false[% END %]; var MSG_NOTHING_TO_SAVE = _("Nothing to save"); var MSG_SAVING = _("Saving..."); diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt index 026f48560f..82a0dc42a1 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt @@ -70,7 +70,7 @@ function AreMandatoriesNotOk(){ [% FOREACH subfield_loo IN innerloo.subfield_loop %] [% IF ( subfield_loo.mandatory ) %]mandatories.push("[% subfield_loo.id | html %]"); tab.push("[% BIG_LOO.number | html %]"); - label.push("[% To.json(subfield_loo.marc_lib) | $raw %]"); + label.push("[% To.json(subfield_loo.marc_lib) | html %]"); [% END %] [% END %] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt index 083eda7c18..776883c340 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt @@ -32,9 +32,9 @@ [% ELSE %] var new_line = " [%- FOREACH SUBFIELD_LOO IN SUBFIELD_LOOP -%]‡ - [%- To.json( SUBFIELD_LOO.marc_subfield ) | $raw -%] + [%- To.json( SUBFIELD_LOO.marc_subfield ) | html -%] [%- FOREACH marc_value IN SUBFIELD_LOO.marc_values -%] - [%- To.json( marc_value ) | $raw -%] + [%- To.json( marc_value ) | html -%] [%- END -%] [%- END -%]‡9[% authid | html %]"; [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt index b1fa37e812..1ce4e9ddee 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt @@ -108,7 +108,7 @@ [%- label = BLOCK %][% e.label | html %][% END -%] [%- escaped.push({ 'value' => value, 'label' => label }) -%] [%- END -%] - [%- To.json(escaped) | $raw -%] + [%- To.json(escaped) | html -%] [%- END -%] [% notforloans = AuthorisedValues.GetDescriptionsByKohaField({ kohafield = 'items.notforloan' }) %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt index 220d7de5ea..92ae625dff 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt @@ -736,7 +736,7 @@ [%- END -%] var search_result = { - query_desc: "[% To.json( query_desc ) | $raw %]", + query_desc: "[% To.json( query_desc ) | html %]", query_cgi: "[% query_cgi | html %]", limit_cgi: "[% limit_cgi | html %]", sort_cgi: "[% sort_cgi | html %]", diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt index 35bad25966..4edfbace20 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt @@ -169,55 +169,55 @@ var subfield = subfields[i+1]; if(code.value == '9'){ - subfield.value = "[% To.json( subfield_value_9 ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_9 ) | html %]"; } if(code.value == '0'){ - subfield.value = "[% To.json( subfield_value_0 ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_0 ) | html %]"; } if(code.value == 'a'){ - subfield.value = "[% To.json( subfield_value_a ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_a ) | html %]"; } if(code.value == 'c'){ - subfield.value = "[% To.json( subfield_value_c ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_c ) | html %]"; } if(code.value == 'd'){ - subfield.value = "[% To.json( subfield_value_d ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_d ) | html %]"; } if(code.value == 'e'){ - subfield.value = "[% To.json( subfield_value_e ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_e ) | html %]"; } if(code.value == 'h'){ - subfield.value = "[% To.json( subfield_value_h ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_h ) | html %]"; } if(code.value == 'i'){ - subfield.value = "[% To.json( subfield_value_i ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_i ) | html %]"; } if(code.value == 'l'){ - subfield.value = "[% To.json( subfield_value_l ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_l ) | html %]"; } if(code.value == 'n'){ - subfield.value = "[% To.json( subfield_value_n ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_n ) | html %]"; } if(code.value == 'o'){ - subfield.value = "[% To.json( subfield_value_o ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_o ) | html %]"; } if(code.value == 'p'){ - subfield.value = "[% To.json( subfield_value_p ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_p ) | html %]"; } if(code.value == 't'){ - subfield.value = "[% To.json( subfield_value_t ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_t ) | html %]"; } if(code.value == 'u'){ - subfield.value = "[% To.json( subfield_value_u ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_u ) | html %]"; } if(code.value == 'v'){ - subfield.value = "[% To.json( subfield_value_v ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_v ) | html %]"; } if(code.value == 'x'){ - subfield.value = "[% To.json( subfield_value_x ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_x ) | html %]"; } if(code.value == 'y'){ - subfield.value = "[% To.json( subfield_value_y ) | $raw %]"; + subfield.value = "[% To.json( subfield_value_y ) | html %]"; } } } diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt index 0014a0f612..c094bf5ade 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt @@ -1592,7 +1592,7 @@ legend:hover { [% IF new_guarantors %] [% FOREACH g IN new_guarantors %] - select_user( '[% g.patron.borrowernumber | html %]', [% To.json( g.patron.unblessed ) | $raw %], '[% g.relationship | html %]' ); + select_user( '[% g.patron.borrowernumber | html %]', [% To.json( g.patron.unblessed ) | html %], '[% g.relationship | html %]' ); [% END %] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt index 38ec5aa9e0..fd55506c11 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/tables/guarantor_search.tt @@ -32,5 +32,5 @@ [%~ IF data.zipcode %][% SET address = address _ data.zipcode _ ' ' %][% END %] [%~ IF data.country %][% SET address = address _ data.country _ ' ' %][% END %] [%~ SET address = address _ Branches.GetName( data.branchcode ) %] -[%~ To.json( address ) | $raw ~%] +[%~ address | html | $To ~%] [% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt index e15d468fcc..dcf16a92af 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt @@ -939,10 +939,10 @@ var biblionumber = "[% biblionumber | $raw %]"; var borrowernumber = "[% patron.borrowernumber | $raw %]"; var MSG_CONFIRM_DELETE_HOLD = _("Are you sure you want to cancel this hold?"); - var patron_homebranch = "[% To.json( Branches.GetName( patron.branchcode ) ) | $raw %]"; + var patron_homebranch = "[% To.json( Branches.GetName( patron.branchcode ) ) | html %]"; var override_items = {[% FOREACH bibitemloo IN bibitemloop %][% FOREACH itemloo IN bibitemloo.itemloop %][% IF ( itemloo.override ) %] [% itemloo.itemnumber | html %]: { - homebranch: "[% To.json( Branches.GetName( itemloo.homebranch ) ) | $raw %]"; + homebranch: "[% To.json( Branches.GetName( itemloo.homebranch ) ) | html %]"; holdallowed: [% itemloo.holdallowed | html %] }, [% END %][% END %][% END %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt index 1075e14d19..8623f43a88 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt @@ -556,7 +556,7 @@ fieldset.rows table { clear: none; margin: 0; } var MSG_MANA_NO_SUBSCRIPTION_FOUND = _("No subscription found on Mana Knowledge Base"); var MSG_MANA_SHARE_PATTERN = _("Please feel free to share your pattern with all others librarians once you are done"); - var BOOKSELLER_IDS = [% To.json( bookseller_ids ) || '[]' | $raw %]; + var BOOKSELLER_IDS = [% To.json( bookseller_ids ) || '[]' | html %]; </script> [% Asset.js("js/subscription-add.js") | $raw %] [% Asset.js("js/showpredictionpattern.js") | $raw %] diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt index a82f0e8dcb..cbac0393a9 100644 --- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt +++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/tables/suggester_search.tt @@ -32,5 +32,5 @@ [%~ IF data.zipcode %][% SET address = address _ data.zipcode _ ' ' %][% END %] [%~ IF data.country %][% SET address = address _ data.country _ ' ' %][% END %] [%~ SET address = address _ Branches.GetName( data.branchcode ) %] -[%~ To.json( address ) | $raw ~%] +[%~ address | html | $To ~%] [% END %] diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt index c428886a4d..6d8622fd0c 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt @@ -440,7 +440,7 @@ return true; } [% IF Koha.Preference('AudioAlerts') %] - var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | $raw %]" ); + var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | html %]" ); $( document ).ready(function() { if ( AUDIO_ALERTS ) { for ( var k in AUDIO_ALERTS ) { -- 2.20.1