Bug 11307 - Potential XSS attack vector in opac rss feed
Summary: Potential XSS attack vector in opac rss feed
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low critical (vote)
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-11-26 16:37 UTC by Chris Cormack
Modified: 2019-06-27 09:24 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 11307 : Potential XSS attack in rss feed (1.40 KB, patch)
2013-11-26 16:40 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) (1.15 KB, patch)
2013-11-26 16:52 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 11307 : Potential XSS attack in rss feed (1.46 KB, patch)
2013-11-26 17:04 UTC, Mark Tompsett
Details | Diff | Splinter Review
Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) (1.20 KB, patch)
2013-11-26 17:04 UTC, Mark Tompsett
Details | Diff | Splinter Review
[PASSED QA] Bug 11307 : Potential XSS attack in rss feed (1.54 KB, patch)
2013-11-26 17:42 UTC, Martin Renvoize
Details | Diff | Splinter Review
[PASSED QA] Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only) (1.28 KB, patch)
2013-11-26 17:43 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2013-11-26 16:37:20 UTC
http://demo.mykoha.co.nz/cgi-bin/koha/opac-search.pl?idx=kw&q=a&count=50%22%27%3Ch1%3Etest%3C/h1%3E&sort_by=acqdate_dsc&format=rss2

If you look at the source you will see 
<opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage>
Comment 1 Chris Cormack 2013-11-26 16:40:03 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2013-11-26 16:52:57 UTC Comment hidden (obsolete)
Comment 3 Mark Tompsett 2013-11-26 17:04:37 UTC Comment hidden (obsolete)
Comment 4 Mark Tompsett 2013-11-26 17:04:52 UTC Comment hidden (obsolete)
Comment 5 Mark Tompsett 2013-11-26 17:08:47 UTC
Tested according to test plan given in comment #1 for prog and bootstrap themes.
Comment 6 Martin Renvoize 2013-11-26 17:42:19 UTC
Created attachment 23175 [details] [review]
[PASSED QA] Bug 11307 : Potential XSS attack in rss feed

To test:
1/ Craft a url like
/cgi-bin/koha/opac-search.pl?q=a&count=50"'<h1>test</h1>&sort_by=acqdate_dsc&format=rss2
2/ look at the source, notice
<opensearch:itemsPerPage>50"'<h1>test</h1></opensearch:itemsPerPage>
3/ apply the patch, and reload url
4/ source now contains
 <opensearch:itemsPerPage>50&quot;'&lt;h1&gt;test&lt;/h1&gt;</opensearch:itemsPerPage>

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 7 Martin Renvoize 2013-11-26 17:43:24 UTC
Created attachment 23176 [details] [review]
[PASSED QA] Bug 11307 : Follow up for bootstrap theme (master and 3.14.x only)

To test:
Same as first patch, but using bootstrap theme

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 8 Martin Renvoize 2013-11-26 17:57:10 UTC
All works as expected, passes QA script.
Comment 9 Galen Charlton 2013-11-26 18:18:41 UTC
Pushed to master and 3.14.x.  Thanks, Chris!
Comment 10 Fridolin Somers 2013-12-13 12:58:05 UTC
Patches will be in 3.14.1
Comment 11 Tomás Cohen Arazi 2013-12-16 13:32:21 UTC
This patch has been pushed to 3.12.x, will be in 3.12.8.

Thanks Chris!