Bug 36382 - XSS in showLastPatron dropdown
Summary: XSS in showLastPatron dropdown
Status: Pushed to stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Templates (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: Kyle M Hall (khall)
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 21246
Blocks: 36385
  Show dependency treegraph
 
Reported: 2024-03-21 10:58 UTC by Nick Clemens (kidclamp)
Modified: 2024-07-25 11:11 UTC (History)
12 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00,23.11.05
Circulation function:


Attachments
Bug 36382: XSS in showLastPatron dropdown (1.65 KB, patch)
2024-03-21 13:31 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 36382: XSS in showLastPatron dropdown (1.70 KB, patch)
2024-03-22 17:38 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 36382: XSS in showLastPatron dropdown (1.79 KB, patch)
2024-03-29 09:26 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 36382 (QA follow-up) Don't escape quotes in escapeHtml (893 bytes, patch)
2024-03-29 11:08 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 36382: XSS in showLastPatron dropdown (1.75 KB, patch)
2024-05-14 17:46 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review
Bug 36382: (QA follow-up) Don't escape quotes in escapeHtml (884 bytes, patch)
2024-05-14 17:46 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Clemens (kidclamp) 2024-03-21 10:58:23 UTC
To recreate:
1 - Set borrower surname to:
    <script>alert("here comes trouble");</script>
2 - Save, nothing happens
3 - Enable showLastPatron 
4 - Reload patron
5 - Here comes trouble indeed
Comment 1 Kyle M Hall (khall) 2024-03-21 13:31:55 UTC
Created attachment 163615 [details] [review]
Bug 36382: XSS in showLastPatron dropdown

1) Set borrower surname to:
    <script>alert("here comes trouble");</script>
2) Save, nothing happens
3) Enable showLastPatron
4) Reload patron
5) Note the alert popup
6) Apply this patch
7) Reload patron
8) No alert!
Comment 2 Owen Leonard 2024-03-22 17:38:37 UTC
Created attachment 163727 [details] [review]
Bug 36382: XSS in showLastPatron dropdown

1) Set borrower surname to:
    <script>alert("here comes trouble");</script>
2) Save, nothing happens
3) Enable showLastPatron
4) Reload patron
5) Note the alert popup
6) Apply this patch
7) Reload patron
8) No alert!

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Comment 3 Marcel de Rooy 2024-03-29 09:26:31 UTC
Created attachment 164119 [details] [review]
Bug 36382: XSS in showLastPatron dropdown

1) Set borrower surname to:
    <script>alert("here comes trouble");</script>
2) Save, nothing happens
3) Enable showLastPatron
4) Reload patron
5) Note the alert popup
6) Apply this patch
7) Reload patron
8) No alert!

Signed-off-by: Owen Leonard <oleonard@myacpl.org>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 4 Jonathan Druart 2024-03-29 09:46:34 UTC
+    "'": '&#39;',
+    '"': '&quot;'

Do you really estimate the possible regression from this? maybe we are already escaping them in some places and they will get double escaped.
Comment 5 Marcel de Rooy 2024-03-29 09:52:33 UTC
(In reply to Jonathan Druart from comment #4)
> +    "'": '&#39;',
> +    '"': '&quot;'
> 
> Do you really estimate the possible regression from this? maybe we are
> already escaping them in some places and they will get double escaped.

Good point
Comment 6 Kyle M Hall (khall) 2024-03-29 11:08:05 UTC
Created attachment 164123 [details] [review]
Bug 36382 (QA follow-up) Don't escape quotes in escapeHtml
Comment 7 Kyle M Hall (khall) 2024-03-29 11:10:17 UTC
(In reply to Jonathan Druart from comment #4)
> +    "'": '&#39;',
> +    '"': '&quot;'
> 
> Do you really estimate the possible regression from this? maybe we are
> already escaping them in some places and they will get double escaped.

Where are we escaping quotes? A grep grep found function encodeHTMLEntities in supplier.tt. HTML escaping really needs to be unified, making bug 36385 all the more important.
Comment 8 David Cook 2024-04-01 23:33:13 UTC
(In reply to Kyle M Hall from comment #7)
> Where are we escaping quotes? A grep grep found function encodeHTMLEntities
> in supplier.tt. HTML escaping really needs to be unified, making bug 36385
> all the more important.

+1
Comment 9 David Cook 2024-04-02 00:13:11 UTC
Also, part of the reason we have XSS issues like these is because we work with the DOM using strings rather than objects. 

Take this particular XSS:

const el = `<li><a href="/cgi-bin/koha/circ/circulation.pl?borrowernumber=${p["borrowernumber"]}">${p["name"]} (${p["card"]})</a></li>`;

Here we could be using a "Safe Sink"[1] for the name and card to eliminate the XSS.

const el = document.createElement('li');
const a_el = document.createElement('a');
a_el.setAttribute('href',`/cgi-bin/koha/circ/circulation.pl?borrowernumber=${p["borrowernumber"]}`);
const link_text = document.createTextNode(`${p["name"]} (${p["card"]})`);
a_el.appendChild(link_text);
el.appendChild(a_el);


[1]
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#safe-sinks

--

Yes, it is more verbose, but it's way safer. It also doesn't need an escape_str. (Not that I think escape_str is bad. The more layers of protection the better I always say.)
Comment 10 David Cook 2024-04-03 22:20:10 UTC
(In reply to David Cook from comment #9)
> Here we could be using a "Safe Sink"[1] for the name and card to eliminate
> the XSS.

Bug 35960 has a clever way of using jquery and strings to create objects without any user input, and then using a safe sink for the user input. So there could be a balance in terms of verbosity as well.
Comment 11 Jonathan Druart 2024-04-16 07:38:15 UTC Comment hidden (obsolete)
Comment 12 Wainui Witika-Park 2024-04-24 01:39:08 UTC
I can't recreate the bug on 22.05 - I also can't apply the patch cleanly
Comment 13 Frédéric Demians 2024-04-24 09:44:48 UTC
(In reply to wainuiwitikapark from comment #12)
> I can't recreate the bug on 22.05 - I also can't apply the patch cleanly

Same on 22.11: previous_patrons doesn't exist on this branch
Comment 14 Kyle M Hall (khall) 2024-04-30 12:49:49 UTC
(In reply to wainuiwitikapark from comment #12)
> I can't recreate the bug on 22.05 - I also can't apply the patch cleanly

I believe the issue was introduced in 23.11.00, so that is ok!
Comment 15 Wainui Witika-Park 2024-05-01 03:15:28 UTC
(In reply to Kyle M Hall from comment #14)
> (In reply to wainuiwitikapark from comment #12)
> > I can't recreate the bug on 22.05 - I also can't apply the patch cleanly
> 
> I believe the issue was introduced in 23.11.00, so that is ok!

Ok cool thanks Kyle

So 22.05, 22.11 and 23.05 can ignore backporting this?
Comment 16 Kyle M Hall (khall) 2024-05-01 10:46:36 UTC
(In reply to wainuiwitikapark from comment #15)
> (In reply to Kyle M Hall from comment #14)
> > (In reply to wainuiwitikapark from comment #12)
> > > I can't recreate the bug on 22.05 - I also can't apply the patch cleanly
> > 
> > I believe the issue was introduced in 23.11.00, so that is ok!
> 
> Ok cool thanks Kyle
> 
> So 22.05, 22.11 and 23.05 can ignore backporting this?

That is correct!
Comment 17 Tomás Cohen Arazi (tcohen) 2024-05-14 17:46:11 UTC
Created attachment 166717 [details] [review]
Bug 36382: XSS in showLastPatron dropdown

1) Set borrower surname to:
    <script>alert("here comes trouble");</script>
2) Save, nothing happens
3) Enable showLastPatron
4) Reload patron
5) Note the alert popup
6) Apply this patch
7) Reload patron
8) No alert!

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 18 Tomás Cohen Arazi (tcohen) 2024-05-14 17:46:14 UTC
Created attachment 166718 [details] [review]
Bug 36382: (QA follow-up) Don't escape quotes in escapeHtml

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 19 Tomás Cohen Arazi (tcohen) 2024-05-14 17:47:01 UTC
Rebased after a few hundred commits pushed to main.
Comment 20 Tomás Cohen Arazi (tcohen) 2024-05-15 20:48:36 UTC
Pushed for 24.05!

Well done everyone, thank you!
Comment 21 Fridolin Somers 2024-05-22 13:06:48 UTC
Bug 21246 since 23.11 so no backport to older branches