Bug 37656 - XSS in Advanced editor for Z39.50 search results
Summary: XSS in Advanced editor for Z39.50 search results
Status: Pushed to oldoldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Cataloging (show other bugs)
Version: unspecified
Hardware: All All
: P3 major
Assignee: Phil Ringnalda
QA Contact: Martin Renvoize (ashimema)
URL:
Keywords: rel_22_11_candidate
Depends on:
Blocks:
 
Reported: 2024-08-15 21:28 UTC by Phil Ringnalda
Modified: 2024-11-14 23:37 UTC (History)
14 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00,24.05.04,23.11.09,23.05.15
Circulation function:


Attachments
Test record for XSS in advanced editor (597 bytes, application/marc)
2024-08-16 03:54 UTC, Phil Ringnalda
Details
Bug 37656: XSS in Advanced editor from Z39.50 search results (2.70 KB, patch)
2024-08-16 15:35 UTC, Phil Ringnalda
Details | Diff | Splinter Review
Bug 37656: XSS in Advanced editor from Z39.50 search results (2.75 KB, patch)
2024-08-21 05:29 UTC, David Cook
Details | Diff | Splinter Review
Bug 37656: XSS in Advanced editor from Z39.50 search results (2.82 KB, patch)
2024-08-21 07:25 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Phil Ringnalda 2024-08-15 21:28:06 UTC
Noticed because for some reason OCLC records cataloged in German for English works have a leading article in the title surrounded by << >>, which in the advanced editor's Z39.50 search results appear as "< > Title" for a record with "<<The>> Title" and for <<A>> Title the word Title appears as a link.

Steps to reproduce:
1. Set  EnableAdvancedCatalogingEditor to Enable
2. Edit any bib record, paste <script>alert('boo ❤')</script> at the end of 245‡a and save
3. Below the search fields in the left sidebar, click Advanced »
4. Check the checkbox for Local catalog, uncheck any others that are checked, and search for anything that will return the record you altered.
5. Get an alert() from Z30.50 search results.
Comment 1 Phil Ringnalda 2024-08-16 03:54:05 UTC
Created attachment 170421 [details]
Test record for XSS in advanced editor

Alas, the advanced editor is cunning enough about the year published to keep me from being able to actually get any XSS into there.
Comment 2 Phil Ringnalda 2024-08-16 15:35:55 UTC
Created attachment 170456 [details] [review]
Bug 37656: XSS in Advanced editor from Z39.50 search results

The Advanced editor inserts data from Z39.50 results into the search results
page without escaping HTML. Whether it's German records with "<<A>> Title"
or someone with a compromised catalog or a book with the title "<em> for
emphasis" it shouldn't.

Test plan:
 1. Not a dependency, but you'll avoid getting even more alerts while batch
    importing by starting with the patch from bug 37654
 2. Without this patch applied, download attachment 170421 [details]
 3. Administration - set the preference EnableAdvancedCatalogingEditor to
    Enable
 4. Cataloging - Stage records for import - browse to the downloaded file -
    Upload file - Stage for import
 5. Once the background job finishes, View batch (getting alerts if you
    didn't apply the patch from bug 37654) - Import this batch into the
    catalog
 6. When the import finishes, Search the catalog for script, on the imported
    record Edit record (if you wind up in the basic editor, Settings - Switch
    to Advanced editor)
 7. In the left sidebar below the search inputs, click Advanced », check
    the checkbox for Local catalog and uncheck any others, then search for
    the Title script
 8. You'll get five alerts, and the word "edition" displayed in huge text
 9. Close the search popup, apply patch, shift+reload the advanced editor
    page to clear your cache
10. Repeat step 7, but this time you won't get any alerts, and you'll see
    the title and the other <script> inclusions.

Sponsored-by: Chetco Community Public Library
Comment 3 David Cook 2024-08-21 05:29:47 UTC
Created attachment 170518 [details] [review]
Bug 37656: XSS in Advanced editor from Z39.50 search results

The Advanced editor inserts data from Z39.50 results into the search results
page without escaping HTML. Whether it's German records with "<<A>> Title"
or someone with a compromised catalog or a book with the title "<em> for
emphasis" it shouldn't.

Test plan:
 1. Not a dependency, but you'll avoid getting even more alerts while batch
    importing by starting with the patch from bug 37654
 2. Without this patch applied, download attachment 170421 [details]
 3. Administration - set the preference EnableAdvancedCatalogingEditor to
    Enable
 4. Cataloging - Stage records for import - browse to the downloaded file -
    Upload file - Stage for import
 5. Once the background job finishes, View batch (getting alerts if you
    didn't apply the patch from bug 37654) - Import this batch into the
    catalog
 6. When the import finishes, Search the catalog for script, on the imported
    record Edit record (if you wind up in the basic editor, Settings - Switch
    to Advanced editor)
 7. In the left sidebar below the search inputs, click Advanced », check
    the checkbox for Local catalog and uncheck any others, then search for
    the Title script
 8. You'll get five alerts, and the word "edition" displayed in huge text
 9. Close the search popup, apply patch, shift+reload the advanced editor
    page to clear your cache
10. Repeat step 7, but this time you won't get any alerts, and you'll see
    the title and the other <script> inclusions.

Sponsored-by: Chetco Community Public Library
Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 4 David Cook 2024-08-21 05:30:04 UTC
Thanks for these patches and the wonderful test plans, Phil. Much appreciated.
Comment 5 Martin Renvoize (ashimema) 2024-08-21 07:25:26 UTC
Created attachment 170523 [details] [review]
Bug 37656: XSS in Advanced editor from Z39.50 search results

The Advanced editor inserts data from Z39.50 results into the search results
page without escaping HTML. Whether it's German records with "<<A>> Title"
or someone with a compromised catalog or a book with the title "<em> for
emphasis" it shouldn't.

Test plan:
 1. Not a dependency, but you'll avoid getting even more alerts while batch
    importing by starting with the patch from bug 37654
 2. Without this patch applied, download attachment 170421 [details]
 3. Administration - set the preference EnableAdvancedCatalogingEditor to
    Enable
 4. Cataloging - Stage records for import - browse to the downloaded file -
    Upload file - Stage for import
 5. Once the background job finishes, View batch (getting alerts if you
    didn't apply the patch from bug 37654) - Import this batch into the
    catalog
 6. When the import finishes, Search the catalog for script, on the imported
    record Edit record (if you wind up in the basic editor, Settings - Switch
    to Advanced editor)
 7. In the left sidebar below the search inputs, click Advanced », check
    the checkbox for Local catalog and uncheck any others, then search for
    the Title script
 8. You'll get five alerts, and the word "edition" displayed in huge text
 9. Close the search popup, apply patch, shift+reload the advanced editor
    page to clear your cache
10. Repeat step 7, but this time you won't get any alerts, and you'll see
    the title and the other <script> inclusions.

Sponsored-by: Chetco Community Public Library
Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 6 Martin Renvoize (ashimema) 2024-08-21 07:25:49 UTC
Thanks for the work here guys, all working as expected.

Passing QA
Comment 7 Wainui Witika-Park 2024-09-11 05:25:51 UTC
Applied to 23.05.x-security
Comment 8 Fridolin Somers 2024-10-01 13:12:04 UTC
Backported to 23.11.x-security
Comment 9 Lucas Gass (lukeg) 2024-10-09 14:32:54 UTC
Backported to 24.05.x for 24.05.04
Comment 10 Katrin Fischer 2024-10-18 10:17:26 UTC
Pushed for 24.11!

Well done everyone, thank you!