Item7595 < Bugs

• Do not register here on develop.twiki.org, login with your twiki.org account.
• Use

Item7848 for generic doc work for TWiki-6.1.1. Use

Item7851 for doc work on extensions that are not part of a release. More... Close
• Anything you create or change in standard webs (Main, TWiki, Sandbox etc) will be automatically reverted on every SVN update.
• Does this site look broken?. Use the LitterTray web for test cases.

AppliesTo:	Component:	Priority:	CurrentState:	WaitingFor:	TargetRelease	ReleasedIn
Engine		Normal	Closed		patch	6.0.2

Security alert:

TWiki:Codev.SecurityAlert-CVE-2014-9325
See related Item7596

Patches:

--- TWiki.pm   (revision 28488)
+++ TWiki.pm   (working copy)
@@ -4803,7 +4803,10 @@
 
 sub QUERYSTRING {
     my $this = shift;
-    return $this->{request}->queryString();
+    my $qs = $this->{request}->queryString();
+    # Item7595: Sanitize QUERYSTRING
+    $qs =~ s/(['\/<>])/'%'.sprintf('%02x', ord($1))/ge;
+    return $qs;
 }
 
 sub QUERYPARAMS {

--- TWiki/UI/View.pm   (revision 28488)
+++ TWiki/UI/View.pm   (working copy)
@@ -349,8 +349,14 @@
       next if ($name eq 'topic');
       push @qparams, $name => $query->param($name);
     }
-    $tmpl =~ s/%QUERYPARAMSTRING%/TWiki::_make_params(1,@qparams)/geo;
 
+    if ( $tmpl =~ /%QUERYPARAMSTRING%/ ) {
+        my $qs = TWiki::_make_params( 1, @qparams );
+        # Item7595: Sanitize QUERYPARAMSTRING
+        $qs =~ s/(['\/<>])/'%'.sprintf('%02x', ord($1))/ge;
+        $tmpl =~ s/%QUERYPARAMSTRING%/$qs/go;
+    }
+
     # extract header and footer from the template, if there is a
     # %TEXT% tag marking the split point. The topic text is inserted
     # in place of the %TEXT% tag. The text before this tag is inserted

-- TWiki:Main/PeterThoeny - 2014-12-09

ItemTemplate
Summary	Security Alert CVE-2014-9325: XSS Vulnerability with QUERYSTRING and QUERYPARAMSTRING Variables
ReportedBy	TWiki:Main.PeterThoeny
Codebase	~twiki4, 6.0.1
SVN Range	TWiki-6.0.1-trunk, Sun, 30 Nov 2014, build 28477
AppliesTo	Engine
Component
Priority	Normal
CurrentState	Closed
WaitingFor
Checkins	TWikirev:28489 TWikirev:28490 TWikirev:28491 TWikirev:28492
TargetRelease	patch
ReleasedIn	6.0.2

Item7595: Security Alert CVE-2014-9325: XSS Vulnerability with QUERYSTRING and QUERYPARAMSTRING Variables

Item Form Data

Edit Form Data

Detail