| Summary: | XSS in Advanced editor for Z39.50 search results | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Phil Ringnalda <phil> |
| Component: | Cataloging | Assignee: | Phil Ringnalda <phil> |
| Status: | Pushed to oldoldstable --- | QA Contact: | Martin Renvoize (ashimema) <martin.renvoize> |
| Severity: | major | ||
| Priority: | P3 | CC: | dcook, didier.gautheron, fridolin.somers, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, philippe.blouin, tomascohen, wainuiwitikapark |
| Version: | unspecified | Keywords: | rel_22_11_candidate |
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
24.11.00,24.05.04,23.11.09,23.05.15
|
|
| Circulation function: | |||
| Attachments: |
Test record for XSS in advanced editor
Bug 37656: XSS in Advanced editor from Z39.50 search results Bug 37656: XSS in Advanced editor from Z39.50 search results Bug 37656: XSS in Advanced editor from Z39.50 search results |
||
Created attachment 170421 [details]
Test record for XSS in advanced editor
Alas, the advanced editor is cunning enough about the year published to keep me from being able to actually get any XSS into there.
Created attachment 170456 [details] [review] Bug 37656: XSS in Advanced editor from Z39.50 search results The Advanced editor inserts data from Z39.50 results into the search results page without escaping HTML. Whether it's German records with "<<A>> Title" or someone with a compromised catalog or a book with the title "<em> for emphasis" it shouldn't. Test plan: 1. Not a dependency, but you'll avoid getting even more alerts while batch importing by starting with the patch from bug 37654 2. Without this patch applied, download attachment 170421 [details] 3. Administration - set the preference EnableAdvancedCatalogingEditor to Enable 4. Cataloging - Stage records for import - browse to the downloaded file - Upload file - Stage for import 5. Once the background job finishes, View batch (getting alerts if you didn't apply the patch from bug 37654) - Import this batch into the catalog 6. When the import finishes, Search the catalog for script, on the imported record Edit record (if you wind up in the basic editor, Settings - Switch to Advanced editor) 7. In the left sidebar below the search inputs, click Advanced », check the checkbox for Local catalog and uncheck any others, then search for the Title script 8. You'll get five alerts, and the word "edition" displayed in huge text 9. Close the search popup, apply patch, shift+reload the advanced editor page to clear your cache 10. Repeat step 7, but this time you won't get any alerts, and you'll see the title and the other <script> inclusions. Sponsored-by: Chetco Community Public Library Created attachment 170518 [details] [review] Bug 37656: XSS in Advanced editor from Z39.50 search results The Advanced editor inserts data from Z39.50 results into the search results page without escaping HTML. Whether it's German records with "<<A>> Title" or someone with a compromised catalog or a book with the title "<em> for emphasis" it shouldn't. Test plan: 1. Not a dependency, but you'll avoid getting even more alerts while batch importing by starting with the patch from bug 37654 2. Without this patch applied, download attachment 170421 [details] 3. Administration - set the preference EnableAdvancedCatalogingEditor to Enable 4. Cataloging - Stage records for import - browse to the downloaded file - Upload file - Stage for import 5. Once the background job finishes, View batch (getting alerts if you didn't apply the patch from bug 37654) - Import this batch into the catalog 6. When the import finishes, Search the catalog for script, on the imported record Edit record (if you wind up in the basic editor, Settings - Switch to Advanced editor) 7. In the left sidebar below the search inputs, click Advanced », check the checkbox for Local catalog and uncheck any others, then search for the Title script 8. You'll get five alerts, and the word "edition" displayed in huge text 9. Close the search popup, apply patch, shift+reload the advanced editor page to clear your cache 10. Repeat step 7, but this time you won't get any alerts, and you'll see the title and the other <script> inclusions. Sponsored-by: Chetco Community Public Library Signed-off-by: David Cook <dcook@prosentient.com.au> Thanks for these patches and the wonderful test plans, Phil. Much appreciated. Created attachment 170523 [details] [review] Bug 37656: XSS in Advanced editor from Z39.50 search results The Advanced editor inserts data from Z39.50 results into the search results page without escaping HTML. Whether it's German records with "<<A>> Title" or someone with a compromised catalog or a book with the title "<em> for emphasis" it shouldn't. Test plan: 1. Not a dependency, but you'll avoid getting even more alerts while batch importing by starting with the patch from bug 37654 2. Without this patch applied, download attachment 170421 [details] 3. Administration - set the preference EnableAdvancedCatalogingEditor to Enable 4. Cataloging - Stage records for import - browse to the downloaded file - Upload file - Stage for import 5. Once the background job finishes, View batch (getting alerts if you didn't apply the patch from bug 37654) - Import this batch into the catalog 6. When the import finishes, Search the catalog for script, on the imported record Edit record (if you wind up in the basic editor, Settings - Switch to Advanced editor) 7. In the left sidebar below the search inputs, click Advanced », check the checkbox for Local catalog and uncheck any others, then search for the Title script 8. You'll get five alerts, and the word "edition" displayed in huge text 9. Close the search popup, apply patch, shift+reload the advanced editor page to clear your cache 10. Repeat step 7, but this time you won't get any alerts, and you'll see the title and the other <script> inclusions. Sponsored-by: Chetco Community Public Library Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Thanks for the work here guys, all working as expected. Passing QA Applied to 23.05.x-security Backported to 23.11.x-security Backported to 24.05.x for 24.05.04 Pushed for 24.11! Well done everyone, thank you! |
Noticed because for some reason OCLC records cataloged in German for English works have a leading article in the title surrounded by << >>, which in the advanced editor's Z39.50 search results appear as "< > Title" for a record with "<<The>> Title" and for <<A>> Title the word Title appears as a link. Steps to reproduce: 1. Set EnableAdvancedCatalogingEditor to Enable 2. Edit any bib record, paste <script>alert('boo ❤')</script> at the end of 245‡a and save 3. Below the search fields in the left sidebar, click Advanced » 4. Check the checkbox for Local catalog, uncheck any others that are checked, and search for anything that will return the record you altered. 5. Get an alert() from Z30.50 search results.