Summary: | XSS vulnerability in basic editor handling of title | ||
---|---|---|---|
Product: | Koha | Reporter: | Phil Ringnalda <phil> |
Component: | Cataloging | Assignee: | Phil Ringnalda <phil> |
Status: | Pushed to oldoldoldstable --- | QA Contact: | David Cook <dcook> |
Severity: | major | ||
Priority: | P3 | CC: | dcook, didier.gautheron, fridolin.somers, jesse, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, philippe.blouin, tomascohen, wainuiwitikapark |
Version: | unspecified | Keywords: | rel_22_11_candidate |
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | Trivial patch | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: |
24.11.00,24.05.04,23.11.09,23.05.15
|
Circulation function: | |
Attachments: |
Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading
Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading |
Description
Phil Ringnalda
2024-08-15 21:19:18 UTC
Created attachment 170414 [details] [review] Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading We stick the title of a bib record you are editing in the basic editor into an <h1> without escaping any HTML it might contain. We should instead escape it. Test plan: 1. Without the patch, search for any record in the catalog and click Edit record (if you are in the advanced editor, switch to the basic one) 2. Tab 2, Field 245, Subfield a, paste <script>alert('boo ❤')</script><h2> at the end of the subfield 3. Save, then from the record detail page select Edit - Edit record 4. You will have gotten an alert(), and the entire form will be the size of an <h2>. That's ugly, so go back to the detail page. 5. Apply patch, restart_all 6. Edit - Edit record 7. Now you should not get an alert, the whole title inluding the <script> should display in italics, and the "(Record number nnn)" after it should not be italicized. Created attachment 170415 [details] [review] Bug 37655: Basic editor needs to HTML-escape the bib record title used as a heading We stick the title of a bib record you are editing in the basic editor into an <h1> without escaping any HTML it might contain. We should instead escape it. Test plan: 1. Without the patch, search for any record in the catalog and click Edit record (if you are in the advanced editor, switch to the basic one) 2. Tab 2, Field 245, Subfield a, paste <script>alert('boo ❤')</script><h2> at the end of the subfield 3. Save, then from the record detail page select Edit - Edit record 4. You will have gotten an alert(), and the entire form will be the size of an <h2>. That's ugly, so go back to the detail page. 5. Apply patch, restart_all 6. Edit - Edit record 7. Now you should not get an alert, the whole title inluding the <script> should display in italics, and the "(Record number nnn)" after it should not be italicized. Signed-off-by: David Cook <dcook@prosentient.com.au> Excellent work here, Phil. Simple yet effective fix. Pushing this straight through to QA since it's such a small change. Applied to 23.05.x-security Backported to 23.11.x-security Backported to 24.05.x for 24.05.04 (In reply to Fridolin Somers from comment #6) > Backported to 23.11.x-security Please update the versions field as well! Pushed for 24.11! Well done everyone, thank you! Pushed to 22.11.x. Will be in next point release. 22.11.25 |