From 28639022770195116b8938c93e3146f26ad69a52 Mon Sep 17 00:00:00 2001 From: Centiljard <89267105+Centiljard@users.noreply.github.com> Date: Sat, 7 Sep 2024 18:12:05 +0200 Subject: [PATCH] Bug 37861: Fix XSS vulnerability in barcode append function When user inputs were appended directly to the barcode table, the values were not properly escaped, allowing potential XSS attacks. This patch ensures that user inputs are sanitized and safely added to the DOM using .text() and .attr() methods to prevent script injection. To test: Enable the "SelfCheckInModule". Open the barcode input form. Enter a barcode with HTML or script tags. Without the patch, observe that the script is executed. Apply the patch. Repeat step 2. Verify that the input is escaped and no script execution occurs. Check that the barcode is properly appended to the table. Documentation: No updates required. Sponsored-by: KillerRabbitAos --- .../bootstrap/en/modules/sci/sci-main.tt | 73 +++++++++++-------- 1 file changed, 44 insertions(+), 29 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt index bc5d1affeb..3de3ac94ee 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt @@ -226,37 +226,52 @@ }); $(document).ready(function() { - // Barcodes scanning table initially hidden - $("#sci_barcodes_table").hide(); - // Control de 'append' button behaviour - $("#sci_append_button").on('click',function( e ){ - // Make sure the form is not submitted by the button - e.preventDefault(); - var barcode = $('#barcode_input').val(); - //var result = validate_barcode( barcode ); - $('#sci_barcodes_table tbody').append( - '