gitea
/
Koha-clms
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bug 37681: Fix XSS in staff interface item URLs on detail page 

This patch uses Javascript objects and safe sinks to prevent XSS
in the item URLs on the staff interface detail page.

It also makes sure those URLs don't get double-escaped. Yippee!

Test plan:
0. Apply the patch
1. Add/edit an item with the following URL:
http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au
2. Add/edit a different item with the following URLs:
http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au |
http://prosentient.com.au?q=http%3A%2F%2Fprosentient.com.au
3. Go to the staff interface detail page
4. Notice that the URLs are not double-encoded!
5. Try out a malicious payload (talk to QA/security about this)
6. Confirm that the malicious payload fails to execute the XSS
7. Celebrate!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
This commit is contained in:
David Cook 2024-08-20 00:54:38 +00:00 committed by Lucas Gass
parent 2dc9dcf87a
commit e94a7e34f3
1 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc
View File

@ -629,10 +629,12 @@
let nodes = '';
if ( row.uri.split(' \| ').length > 1 ) {
row.uri.split(' \| ').forEach((uri, i) => {
nodes += '<a href="%s">%s</a><br/>'.format(escape_str(uri), escape_str(uri));
let node = safe_link(uri,uri);
nodes += node.outerHTML + "<br>";
});
} else {
nodes += '<a href="%s">%s</a><br/>'.format(escape_str(row.uri), escape_str(url_link_text));
let node = safe_link(row.uri,url_link_text);
nodes += node.outerHTML;
}
return nodes;
}
@ -846,5 +848,18 @@
return items_table;
}
function safe_link(uri,link_text) {
let node = document.createElement('a');
let url_str = '#';
try {
const safe_url = new URL(uri);
url_str = safe_url.href;
} catch (e) {
//console.error('Invalid URL:', e);
}
node.setAttribute('href',url_str);
node.textContent = link_text;
return node;
}
</script>
[% END %]