From 28639022770195116b8938c93e3146f26ad69a52 Mon Sep 17 00:00:00 2001 From: Artur Date: Sat, 7 Sep 2024 18:12:05 +0200 Subject: [PATCH] Bug 37861: Fix XSS vulnerability in barcode append function When user inputs were appended directly to the barcode table, the values were not properly escaped, allowing potential XSS attacks. This patch ensures that user inputs are sanitized and safely added to the DOM using .text() and .attr() methods to prevent script injection. To test: Enable the "SelfCheckInModule". Open the barcode input form. Enter a barcode with HTML or script tags. Without the patch, observe that the script is executed. Apply the patch. Repeat step 2. Verify that the input is escaped and no script execution occurs. Check that the barcode is properly appended to the table. Documentation: No updates required. Sponsored-by: KillerRabbitAos --- .../bootstrap/en/modules/sci/sci-main.tt | 73 +++++++++++-------- 1 file changed, 44 insertions(+), 29 deletions(-) diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt index bc5d1affeb..3de3ac94ee 100644 --- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt +++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt @@ -226,37 +226,52 @@ }); $(document).ready(function() { - // Barcodes scanning table initially hidden - $("#sci_barcodes_table").hide(); - // Control de 'append' button behaviour - $("#sci_append_button").on('click',function( e ){ - // Make sure the form is not submitted by the button - e.preventDefault(); - var barcode = $('#barcode_input').val(); - //var result = validate_barcode( barcode ); - $('#sci_barcodes_table tbody').append( - '' + - barcode + - '' + - '' ); - // Make sure the table is now displayed - $("#sci_barcodes_table").show(); - $('#sci_checkin_button').show(); - $('#sci_refresh_button').show(); - barcodes.push(barcode); - // clean the input, reset the focus - $('#barcode_input').val(''); - dofocus(); - }); + // Barcodes scanning table initially hidden + $("#sci_barcodes_table").hide(); + + // Control the 'append' button behaviour + $("#sci_append_button").on('click', function(e) { + // Make sure the form is not submitted by the button + e.preventDefault(); + + var barcode = $('#barcode_input').val().trim(); // Trim whitespace from input + + if (barcode !== "") { + // Properly escape the barcode value by using .text() for display + var barcodeHtml = $(''); + barcodeHtml.find('td').text(barcode).append( + $('').attr({ + type: 'hidden', + name: 'barcode', + value: barcode + }) + ); + + $('#sci_barcodes_table tbody').append(barcodeHtml); + + // Make sure the table is now displayed + $("#sci_barcodes_table").show(); + $('#sci_checkin_button').show(); + $('#sci_refresh_button').show(); + + // Add barcode to the array + barcodes.push(barcode); + } + + // Clear the input and reset the focus + $('#barcode_input').val(''); + dofocus(); + }); - $(".helpModal-trigger").on("click",function(e){ - e.preventDefault(); - $("#helpModal").modal("show"); - }); + $(".helpModal-trigger").on("click", function(e) { + e.preventDefault(); + $("#helpModal").modal("show"); + }); + + // Set focus at the beginning + dofocus(); +}); - // set focus at the beginning - dofocus(); - }); var idleTime = 0; $(document).ready(function () { -- 2.44.0