Summary: | HTML injection in "back to results" link from search page | ||
---|---|---|---|
Product: | Koha | Reporter: | Michał Górny <mgorny> |
Component: | Searching | Assignee: | Michał Górny <mgorny> |
Status: | RESOLVED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | normal | ||
Priority: | P5 - low | CC: | 1joynelson, anthony.laquerre, dcook, didier.gautheron, fridolin.somers, jonathan.druart, laurent.ducos, lucas, m.de.rooy, martin.renvoize, nick, tomascohen, virgil.dupras |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | Small patch | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: |
23.11.00,23.05.02
|
Circulation function: | |
Attachments: |
Trivial patch
Bug 34023: Prevent HTML injection in "back to results" link from search page Bug 34023: Prevent HTML injection in "back to results" link from search page |
Description
Michał Górny
2023-06-15 13:04:53 UTC
Created attachment 152420 [details] [review] Bug 34023: Prevent HTML injection in "back to results" link from search page It is possible inject raw HTML into the "Back to search results" link by leading the user to a search with specially crafted URL. For example, using the demo instance: 1. Visit https://koha.adminkuhn.ch/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1&%22%3Etest%3Ca%20foo=%22 2. Refresh the page (for some reason, "back to results" doesn't appear unless I do that at least once). 3. Click any result. Note that the result page now contains: <a href="opac-search.pl?idx=&q=test&weight_search=1&">test<a foo=%22" title="... i.e. `">test<a ...` was successfully injected into the HTML. I'm attaching a quick patch I've used to patch up our instance. It just indiscriminately URI-escapes all parameter keys. I didn't decode them back since as far as I understand all valid keys do not contain special characters. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> I'll look at this one tomorrow There is not much checking here with $raw: koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt: <a href="opac-search.pl?[% busc | $raw %]" title="Back to the results search list">Back to results</a> This whole busc code is not very clear. But the patch is a quick solution. And seems(!) not to create encoding problems. Created attachment 153865 [details] [review] Bug 34023: Prevent HTML injection in "back to results" link from search page It is possible inject raw HTML into the "Back to search results" link by leading the user to a search with specially crafted URL. For example, using the demo instance: 1. Visit https://koha.adminkuhn.ch/cgi-bin/koha/opac-search.pl?idx=&q=test&weight_search=1&%22%3Etest%3Ca%20foo=%22 2. Refresh the page (for some reason, "back to results" doesn't appear unless I do that at least once). 3. Click any result. Note that the result page now contains: <a href="opac-search.pl?idx=&q=test&weight_search=1&">test<a foo=%22" title="... i.e. `">test<a ...` was successfully injected into the HTML. I'm attaching a quick patch I've used to patch up our instance. It just indiscriminately URI-escapes all parameter keys. I didn't decode them back since as far as I understand all valid keys do not contain special characters. Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Thanks for looking at that one, Marcel. Pushed to master for 23.11. Nice work everyone, thanks! Pushed to 23.05.x for 23.05.02 |