Bug 38468

Summary: Staff interface detail page vulnerable to reflected XSS
Product: Koha Reporter: David Cook <dcook>
Component: Staff interfaceAssignee: David Cook <dcook>
Status: RESOLVED FIXED QA Contact: Baptiste Wojtkowski (bwoj) <baptiste.wojtkowski>
Severity: normal    
Priority: P5 - low CC: baptiste.wojtkowski, dcook, didier.gautheron, fridolin.somers, gmcharlt, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, phil, philippe.blouin, tomascohen, victor
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38467
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=28559
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.05.00,24.11.01,24.05.06,23.11.11,22.11.23
Circulation function:
Attachments: Bug 38468: Add double quotes to some template strings
Bug 38468: Add double quotes to some template strings
Bug 38468: Add double quotes to some template strings

Description David Cook 2024-11-18 02:37:57 UTC
While investigating other issues, I noticed that http://localhost:8081/cgi-bin/koha/catalogue/detail.pl is vulnerable to reflected XSS.
Comment 3 David Cook 2024-11-18 04:16:42 UTC
Created attachment 174656 [details] [review]
Bug 38468: Add double quotes to some template strings

This change adds double quotes to some template strings where
quotes are missing all together or single quotes are used incorrectly.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test
2. Click on "Gairm"
3. Use the shelf browser to go to the next result
4. Note that everything loads correctly

5. To test that the security hole has been fixed, try some of the
proof-of-concept attacks provided for biblionumber and searchid
Comment 4 Victor Grousset/tuxayo 2024-11-30 03:15:04 UTC
Created attachment 175034 [details] [review]
Bug 38468: Add double quotes to some template strings

This change adds double quotes to some template strings where
quotes are missing all together or single quotes are used incorrectly.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test
2. Click on "Gairm"
3. Use the search result navigation box to go to the next result
   On the left of the page. Just bellow the breadcrumb and
   left of the record title.
4. Note that everything loads correctly

5. To test that the security hole has been fixed, try some of the
proof-of-concept attacks provided for biblionumber and searchid

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 5 Victor Grousset/tuxayo 2024-11-30 03:16:57 UTC
It works! :)

> 3. Use the shelf browser to go to the next result

It seems to be about the navigation box on the left of the page. Just bellow the breadcrumb and left of the record title.
(<div> with class="browse-controls")


Test plan was amended to reflect this. Feel free to amend again to clarify more. Like with the proper name for the "search result navigation box".
Comment 8 Baptiste Wojtkowski (bwoj) 2025-01-02 14:34:23 UTC
Created attachment 176055 [details] [review]
Bug 38468: Add double quotes to some template strings

This change adds double quotes to some template strings where
quotes are missing all together or single quotes are used incorrectly.

Test plan:
0. Apply the patch
1. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=test
2. Click on "Gairm"
3. Use the search result navigation box to go to the next result
   On the left of the page. Just bellow the breadcrumb and
   left of the record title.
4. Note that everything loads correctly

5. To test that the security hole has been fixed, try some of the
proof-of-concept attacks provided for biblionumber and searchid

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Baptiste Wojtkowski <baptiste.wojtkowski@biblibre.com>
Comment 9 Baptiste Wojtkowski (bwoj) 2025-01-02 14:49:39 UTC
Tested on all provided example, working. QA tool happy, passing QA
Comment 10 Marcel de Rooy 2025-01-10 08:30:44 UTC
(In reply to Baptiste Wojtkowski (bwoj) from comment #9)
> Tested on all provided example, working. QA tool happy, passing QA

Do we still need this one? See bug 38467.
Comment 11 David Cook 2025-01-12 23:34:23 UTC
(In reply to Marcel de Rooy from comment #10)
> (In reply to Baptiste Wojtkowski (bwoj) from comment #9)
> > Tested on all provided example, working. QA tool happy, passing QA
> 
> Do we still need this one? See bug 38467.

Yep, bug 38467 only affects the "url" and "uri" filters - not the "html" filter. 

I don't want to be auto-banned by Bugzilla, so I won't add the links here, but you can see the template::Manual::Filters documentation or the Template::Filters::html_filter() function for more info.
Comment 12 Katrin Fischer 2025-01-14 14:50:09 UTC
Pushed for 25.05!

Well done everyone, thank you!
Comment 13 Katrin Fischer 2025-01-17 11:47:57 UTC
These patches have been included in all maintained versions, see "Version(s) released in".