Bug 13609 - Cross Site Scripting problem in authority search
Summary: Cross Site Scripting problem in authority search
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: master
Hardware: All All
: P5 - low critical (vote)
Assignee: Katrin Fischer
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-22 12:18 UTC by Katrin Fischer
Modified: 2016-06-21 21:36 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 13609: Cross Site Scripting problem in authority search result list paging (3.74 KB, patch)
2015-01-22 13:49 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 13609: Cross Site Scripting problem in authority search result list paging (3.80 KB, patch)
2015-01-22 14:38 UTC, Jonathan Druart
Details | Diff | Splinter Review
[SIGNED OFF] Bug 13609: Cross Site Scripting problem in authority search result list paging (3.87 KB, patch)
2015-01-22 19:27 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 13609: Cross Site Scripting problem in authority search result list paging (3.91 KB, patch)
2015-01-22 19:38 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 13609: Patch for 3.16.x and 3.14.x (3.16.x needs both, 3.14.x just this) (3.47 KB, patch)
2015-01-22 19:44 UTC, Chris Cormack
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2015-01-22 12:18:41 UTC
One of our libraries asked a company for penetration tests of their web applications. In Koha they identified a problem in the authority search:

To test:
- Use an installation with a number of authorities, so that you can have a search result page that has paging on top
- Activate OpacAuthorities
- 'mouseover' the paging on top or at the bottom of the page, an alert window shows.

.../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc%22%20onmouseover%3dprompt%28%27name%27%29%20bad%3d%22&type=opac&value=test

I could reproduce the problem in 3.12.9 and 3.18.2.
Comment 1 Katrin Fischer 2015-01-22 13:08:19 UTC
Without the mouseover:
/cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>
Comment 2 Katrin Fischer 2015-01-22 13:49:50 UTC Comment hidden (obsolete)
Comment 3 Jonathan Druart 2015-01-22 14:38:35 UTC Comment hidden (obsolete)
Comment 4 Katrin Fischer 2015-01-22 14:42:17 UTC
I haven't done more tests yet, but I think for the earlier versions that still include the prog theme we need to fix the file there as well (problem was found in a 3.12). Will try to write one tonight, but happy if someone can provide one earlier.
Comment 5 Tomás Cohen Arazi 2015-01-22 19:27:36 UTC Comment hidden (obsolete)
Comment 6 Chris Cormack 2015-01-22 19:38:18 UTC
Created attachment 35476 [details] [review]
Bug 13609: Cross Site Scripting problem in authority search result list paging

To test:
- Use an installation a reasonable amount of authorities, so that you can
  have a search result list with more than one page
- Activate OpacAuthorities
- Create an OPAC link like shown below, verify that an alert is shown
- Apply patch
- Refresh the page and no alert should appear
- Verify the paging still works correctly for 'numbers' and 'arrows'

URL:
.../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>

Signed-off-by: Jonathan Druart <jonathan.druart@biblibre.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 7 Chris Cormack 2015-01-22 19:44:51 UTC
Created attachment 35477 [details] [review]
Bug 13609: Patch for 3.16.x and 3.14.x (3.16.x needs both, 3.14.x just this)

To Test:

- Use an installation a reasonable amount of authorities, so that you
  can have a search result list with more than one page
- Activate OpacAuthorities
- Create an OPAC link like shown below, verify that an alert is shown
- Apply patch
- Refresh the page and no alert should appear
- Verify the paging still works correctly for 'numbers' and 'arrows'

URL: .../cgi-bin/koha/opac-authorities-home.pl?and_or=and&marclist=match&op=do_search&operator=contains&orderby=HeadingAsc2"><script>prompt(987898)</script>
Comment 8 Tomás Cohen Arazi 2015-01-22 19:45:59 UTC
Patch pushed to master.

Thanks Katrina!
Comment 9 Fridolin SOMERS 2015-01-23 09:29:04 UTC
Pushed to 3.14.x will be in 3.14.13
Comment 10 Chris Cormack 2015-01-23 20:49:42 UTC
Is in 3.18.x and 3.16.x also