From 9e4de6dc600ad23747d6354020d9427707434f0e Mon Sep 17 00:00:00 2001 From: David Cook Date: Tue, 25 Mar 2025 00:40:26 +0000 Subject: [PATCH] Bug 38969: [alternate] Prevent self-XSS when testing tags in staff interface MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This change refactors the tag test in the staff interface to use more standard Javascript/JSON for passing messages and writing HTML. Test plan: - Apply the patch and koha-plack --restart kohadev - Go to Admin > Tools > Tags - Paste "" into the input field under the "Check lists" heading - Click on "Test" - Note that the following test appears below the Test button: is neither permitted nor prohibited! --- koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js | 6 +++--- tags/review.pl | 5 +++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js b/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js index 67b68b7dec..20c956a888 100644 --- a/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js +++ b/koha-tmpl/intranet-tmpl/prog/js/pages/tags-review.js @@ -59,10 +59,10 @@ var failure_test = function (tag) { $("#verdict").html(__("%s is prohibited!").format(decodeURIComponent(tag))); }; var indeterminate_test = function (tag) { + const span = document.createElement("span"); + span.textContent = tag; $("#verdict").html( - __("%s is neither permitted nor prohibited!").format( - decodeURIComponent(tag) - ) + __("%s is neither permitted nor prohibited!").format(span.innerHTML) ); }; diff --git a/tags/review.pl b/tags/review.pl index 82b82ace28..ed1523116d 100755 --- a/tags/review.pl +++ b/tags/review.pl @@ -34,6 +34,7 @@ use C4::Tags qw( is_approved whitelist ); +use JSON; my $script_name = "/cgi-bin/koha/tags/review.pl"; my $needed_flags = { tools => 'moderate_tags' }; # FIXME: replace when more specific permission is created. @@ -63,8 +64,8 @@ if ( is_ajax() ) { my $check = is_approved($tag); $js_reply = ( $check >= 1 ? 'success' : $check <= -1 ? 'failure' : 'indeterminate' ) - . "_test('" - . uri_escape_utf8($tag) . "');\n"; + . "_test(" + . JSON::encode_json($tag) . ");\n"; } elsif ( $op eq 'cud-approve' ) { $js_reply = ( whitelist( $operator, $tag ) ? 'success' : 'failure' ) . "_approve('" . uri_escape_utf8($tag) . "');\n"; -- 2.39.5