From bd06f263fcd9ba178ad0cf866dbf4b27884e868f Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Tue, 15 Aug 2017 16:21:48 -0300 Subject: [PATCH] Bug 19121: [PoC] Prevent XSS - Escape variables when sent to scripts We will need to adapt Koha::CGI->param to work in list context (even if it is considered bad), and explicitely call ->param_raw when we do not want the escape to be done. --- Koha/CGI.pm | 31 +++++++++++++++++++++++++++++++ members/moremember.pl | 3 ++- 2 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 Koha/CGI.pm diff --git a/Koha/CGI.pm b/Koha/CGI.pm new file mode 100644 index 0000000000..327331f426 --- /dev/null +++ b/Koha/CGI.pm @@ -0,0 +1,31 @@ +package Koha::CGI; + +use Modern::Perl; +use base qw( CGI ); + +sub param { + my ( $self, $params ) = @_; + my $value = $self->SUPER::param($params); + return unless $value; + return $self->_escape($value); +} + +sub param_raw { + my ( $self, $params ) = @_; + return $self->SUPER::param($params); +} + +# Picked from Template::Stash::AutoEscaping::Escaped::HTML +sub _escape { + my ( $self, $text ) = @_; + for ($text) { + s/&/&/g; + s//>/g; + s/"/"/g; + s/'/'/g; + } + return $text; +} + +1; diff --git a/members/moremember.pl b/members/moremember.pl index b70a068150..972cc52b70 100755 --- a/members/moremember.pl +++ b/members/moremember.pl @@ -36,6 +36,7 @@ use strict; #use warnings; FIXME - Bug 2505 use CGI qw ( -utf8 ); +use Koha::CGI; use C4::Context; use C4::Auth; use C4::Output; @@ -75,7 +76,7 @@ BEGIN { my $dbh = C4::Context->dbh; -my $input = CGI->new; +my $input = Koha::CGI->new; $debug or $debug = $input->param('debug') || 0; my $print = $input->param('print'); -- 2.11.0