Skip to content

Commit 1c2c482

Browse files
ericvaanderingericvaandering
authored
Merge pull request #99 from ericvaandering/cern_1904_hotfix
Fix possible XSS
2 parents c7400c5 + 76f8de1 commit 1c2c482

9 files changed

Lines changed: 68 additions & 56 deletions

File tree

‎DocDB/cgi/DisplayMeeting‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ if (!$dbh) {
8585
}
8686

8787
my @Scripts = ("PopUps");
88-
push @Scripts,"jquery/jquery-3.0.0.min","jquery/jquery.tablesorter.min","jquery/jquery.tablesorter.widgets";
88+
push @Scripts,"jquery/jquery-3.5.1.slim.min","jquery/jquery.tablesorter.min","jquery/jquery.tablesorter.widgets";
8989
@JQueryElements = ("tablesorter");
9090
push @Scripts,"JQueryReady";
9191

‎DocDB/cgi/DocDBVersion.pm‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,6 @@
2121
# along with DocDB; if not, write to the Free Software
2222
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
2323

24-
$DocDBVersion = "8.8.9p2";
24+
$DocDBVersion = "8.8.10b1";
2525

2626
1;

‎DocDB/cgi/DocumentDatabase‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ if ($UserValidation eq "certificate") {
5656
}
5757

5858
my @Scripts = ("PopUps");
59-
push @Scripts,"jquery/jquery-3.0.0.min","jquery/jquery.tablesorter.min","jquery/jquery.tablesorter.widgets";
59+
push @Scripts,"jquery/jquery-3.5.1.slim.min","jquery/jquery.tablesorter.min","jquery/jquery.tablesorter.widgets";
6060
@JQueryElements = ("tablesorter");
6161
push @Scripts,"JQueryReady";
6262

‎DocDB/cgi/ListBy‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ require "UntaintInput.pm";
4040
require "DocumentUtilities.pm";
4141

4242
my @Scripts = ("PopUps");
43-
push @Scripts,"jquery/jquery-3.0.0.min","jquery/jquery.tablesorter.min","jquery/jquery.tablesorter.widgets";
43+
push @Scripts,"jquery/jquery-3.5.1.slim.min","jquery/jquery.tablesorter.min","jquery/jquery.tablesorter.widgets";
4444
@JQueryElements = ("tablesorter");
4545
push @Scripts,"JQueryReady";
4646

‎DocDB/cgi/Search‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,15 @@
2727

2828
use Benchmark;
2929
use CGI;
30+
use CGI::Untaint;
3031
use DBI;
3132

3233
$StartTime = new Benchmark;
3334

3435
require "DocDBGlobals.pm";
3536
require "HTMLUtilities.pm";
3637
require "Search.pm";
38+
require "UntaintInput.pm";
3739

3840
$query = new CGI; # Global for subroutines
3941
$query -> autoEscape(0);
@@ -42,12 +44,14 @@ $dbh = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
4244

4345
# Need these unsanitized to perform searches. Never printed anyhow.
4446
my %CGIParams = $query -> Vars;
47+
my $Untaint = CGI::Untaint -> new($query -> Vars);
4548

4649
### Pull info out of params into local variables
4750

48-
my $OutFormat = $CGIParams{outformat} || "HTML";
51+
my $OutFormat = $Untaint -> extract(-as_printable => "outformat") || "HTML";
4952
$OutFormat =~ tr/[a-z]/[A-Z]/;
5053

54+
$query -> delete_all();
5155
LocalSearch( {-cgiparams => \%CGIParams} );
5256

5357
### Print footers

‎DocDB/cgi/Search.pm‎

Lines changed: 55 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@ sub LocalSearch ($) {
3535
my %params = exists $ArgRef->{-cgiparams} ? %{$ArgRef->{-cgiparams}} : ();
3636
my $NoXMLHead = exists $ArgRef->{-noxmlhead} ? $ArgRef->{-noxmlhead} : $FALSE;
3737

38+
use CGI::Untaint;
39+
require "UntaintInput.pm";
40+
3841
require "FSUtilities.pm";
3942
require "WebUtilities.pm";
4043
require "Utilities.pm";
@@ -58,58 +61,61 @@ sub LocalSearch ($) {
5861

5962
### Pull info out of params into local variables
6063

61-
my $OutFormat = $params{outformat} || "HTML";
62-
63-
$InnerLogic = $params{innerlogic} || "OR";
64-
$OuterLogic = $params{outerlogic} || "AND";
65-
66-
$TitleSearch = $params{titlesearch};
67-
$TitleSearchMode = $params{titlesearchmode};
68-
$AbstractSearch = $params{abstractsearch};
69-
$AbstractSearchMode = $params{abstractsearchmode};
70-
$KeywordSearch = $params{keywordsearch};
71-
$KeywordSearchMode = $params{keywordsearchmode};
72-
$RevisionNoteSearch = $params{revisionnotesearch};
73-
$RevisionNoteSearchMode = $params{revisionnotesearchmode};
74-
$PubInfoSearch = $params{pubinfosearch};
75-
$PubInfoSearchMode = $params{pubinfosearchmode};
76-
$FileSearch = $params{filesearch};
77-
$FileSearchMode = $params{filesearchmode};
78-
$FileDescSearch = $params{filedescsearch};
79-
$FileDescSearchMode = $params{filedescsearchmode};
80-
$FileContSearch = $params{filecontsearch};
81-
$FileContSearchMode = $params{filecontsearchmode};
82-
83-
my $AuthorManual = $params{authormanual};
84-
@RequesterSearchIDs = split /\0/,$params{requestersearch};
85-
@AuthorSearchIDs = split /\0/,$params{authors};
86-
@TypeSearchIDs = split /\0/,$params{doctypemulti};
87-
88-
my @TopicSearchIDs = split /\0/,$params{topics};
89-
my $IncludeSubTopics = $params{includesubtopics};
64+
my $Untaint = CGI::Untaint -> new(%params);
65+
66+
my $OutFormat = $Untaint -> extract(-as_printable => "outformat") || "HTML";
67+
68+
$InnerLogic = $Untaint -> extract(-as_printable => "innerlogic") || "OR";
69+
$OuterLogic = $Untaint -> extract(-as_printable => "outerlogic") || "AND";
70+
71+
$TitleSearch = $Untaint -> extract(-as_printable => "titlesearch");
72+
$TitleSearchMode = $Untaint -> extract(-as_printable => "titlesearchmode");
73+
$AbstractSearch = $Untaint -> extract(-as_printable => "abstractsearch");
74+
$AbstractSearchMode = $Untaint -> extract(-as_printable => "abstractsearchmode");
75+
$KeywordSearch = $Untaint -> extract(-as_printable => "keywordsearch");
76+
$KeywordSearchMode = $Untaint -> extract(-as_printable => "keywordsearchmode");
77+
$RevisionNoteSearch = $Untaint -> extract(-as_printable => "revisionnotesearch");
78+
$RevisionNoteSearchMode = $Untaint -> extract(-as_printable => "revisionnotesearchmode");
79+
$PubInfoSearch = $Untaint -> extract(-as_printable => "pubinfosearch");
80+
$PubInfoSearchMode = $Untaint -> extract(-as_printable => "pubinfosearchmode");
81+
$FileSearch = $Untaint -> extract(-as_printable => "filesearch");
82+
$FileSearchMode = $Untaint -> extract(-as_printable => "filesearchmode");
83+
$FileDescSearch = $Untaint -> extract(-as_printable => "filedescsearch");
84+
$FileDescSearchMode = $Untaint -> extract(-as_printable => "filedescsearchmode");
85+
$FileContSearch = $Untaint -> extract(-as_printable => "filecontsearch");
86+
$FileContSearchMode = $Untaint -> extract(-as_printable => "filecontsearchmode");
87+
88+
my $AuthorManual = $Untaint -> extract(-as_printable => "authormanual");
89+
90+
@RequesterSearchIDs = @{ $Untaint -> extract(-as_listofint => "requestersearch") || undef };
91+
@AuthorSearchIDs = @{ $Untaint -> extract(-as_listofint => "authors") || undef };
92+
@TypeSearchIDs = @{ $Untaint -> extract(-as_listofint => "doctypemulti") || undef };
93+
94+
my @TopicSearchIDs = @{ $Untaint -> extract(-as_listofint => "topics") || undef };
95+
my $IncludeSubTopics = $Untaint -> extract(-as_printable => "includesubtopics");
9096
if ($IncludeSubTopics) {
9197
$IncludeSubTopics = $TRUE;
9298
}
9399

94100
push @DebugStack,"Searching for topics ".join ', ',@TopicSearchIDs;
95-
my @EventSearchIDs = split /\0/,$params{events};
96-
my @EventGroupSearchIDs = split /\0/,$params{eventgroups};
101+
my @EventSearchIDs = @{ $Untaint -> extract(-as_listofint => "events") || undef };
102+
my @EventGroupSearchIDs = @{ $Untaint -> extract(-as_listofint => "eventgroups") || undef };
97103

98104
### Parameters for simple search
99105

100-
my $Simple = $params{simple};
101-
my $SimpleText = $params{simpletext};
106+
my $Simple = $Untaint -> extract(-as_integer => "simple");
107+
my $SimpleText = $Untaint -> extract(-as_printable => "simpletext");
102108

103109
### Purify input (remove punctuation)
104110

105-
# $SimpleText =~ s/[^\s\w+-\.]//go;
106-
# $TitleSearch =~ s/[^\s\w+-\.]//go;
107-
# $AbstractSearch =~ s/[^\s\w+-\.]//go;
108-
# $KeywordSearch =~ s/[^\s\w+-\.]//go;
109-
# $RevisionNoteSearch =~ s/[^\s\w+-\.]//go;
110-
# $PubInfoSearch =~ s/[^\s\w+-\.]//go;
111-
# $FileSearch =~ s/[^\s\w+-\.]//go;
112-
# $FileDescSearch =~ s/[^\s\w+-\.]//go;
111+
$SimpleText =~ s/[^\s\w+-\.]//go;
112+
$TitleSearch =~ s/[^\s\w+-\.]//go;
113+
$AbstractSearch =~ s/[^\s\w+-\.]//go;
114+
$KeywordSearch =~ s/[^\s\w+-\.]//go;
115+
$RevisionNoteSearch =~ s/[^\s\w+-\.]//go;
116+
$PubInfoSearch =~ s/[^\s\w+-\.]//go;
117+
$FileSearch =~ s/[^\s\w+-\.]//go;
118+
$FileDescSearch =~ s/[^\s\w+-\.]//go;
113119
$FileContSearch =~ s/[^\s\w+-\.]//go; # No idea what they'd do with special characters, best to remove
114120

115121
GetTopics();
@@ -122,7 +128,7 @@ sub LocalSearch ($) {
122128
}
123129
NewXMLOutput();
124130
} else {
125-
my @Scripts = ("jquery/jquery-3.0.0.min","jquery/jquery.tablesorter.min","jquery/jquery.tablesorter.widgets");
131+
my @Scripts = ("jquery/jquery-3.5.1.slim.min","jquery/jquery.tablesorter.min","jquery/jquery.tablesorter.widgets");
126132
@JQueryElements = ("tablesorter");
127133
push @Scripts,"JQueryReady";
128134

@@ -180,25 +186,25 @@ sub LocalSearch ($) {
180186
}
181187
}
182188

183-
$Afterday = $params{afterday};
184-
$Aftermonth = $params{aftermonth};
185-
$Afteryear = $params{afteryear};
189+
$Afterday = $Untaint -> extract(-as_printable => "afterday");
190+
$Aftermonth = $Untaint -> extract(-as_printable => "aftermonth");
191+
$Afteryear = $Untaint -> extract(-as_printable => "afteryear");
186192
if ($Afteryear && $Afteryear ne "----") {
187193
if ($Aftermonth eq "---") {$Aftermonth = "Jan";}
188194
if ($Afterday eq "--") {$Afterday = "1";}
189195
$SQLBegin = "$Afteryear-$ReverseAbrvMonth{$Aftermonth}-$Afterday";
190196
}
191197

192-
$Beforeday = $params{beforeday};
193-
$Beforemonth = $params{beforemonth};
194-
$Beforeyear = $params{beforeyear};
198+
$Beforeday = $Untaint -> extract(-as_printable => "beforeday");
199+
$Beforemonth = $Untaint -> extract(-as_printable => "beforemonth");
200+
$Beforeyear = $Untaint -> extract(-as_printable => "beforeyear");
195201
if ($Beforeyear && $Beforeyear ne "----") {
196202
if ($Beforemonth eq "---") {$Beforemonth = "Dec";}
197203
if ($Beforeday eq "--") {$Beforeday = DaysInMonth($ReverseAbrvMonth{$Beforemonth},$Beforeyear);}
198204
$SQLEnd = "$Beforeyear-$ReverseAbrvMonth{$Beforemonth}-$Beforeday";
199205
}
200206

201-
my $Mode = $params{mode};
207+
my $Mode = $Untaint -> extract(-as_printable => "mode");
202208
unless ($Mode eq "date" or $Mode eq "meeting" or $Mode eq "conference" or $Mode eq "title") {
203209
$Mode = "date";
204210
}

‎DocDB/cgi/SelectEmailPrefs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ if ($Mode eq "newuser") {
153153
}
154154

155155
my @Scripts = ("PopUps");
156-
push @Scripts,"jquery/jquery-3.0.0.min","jquery/jquery.tablesorter.min","jquery/jquery.tablesorter.widgets";
156+
push @Scripts,"jquery/jquery-3.5.1.slim.min","jquery/jquery.tablesorter.min","jquery/jquery.tablesorter.widgets";
157157
@JQueryElements = ("tablesorter");
158158
push @Scripts,"JQueryReady";
159159

‎DocDB/cgi/SignatureReport‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ $dbh = DBI->connect('DBI:mysql:'.$db_name.':'.$db_host,$db_rouser,$db_ropass);
6363

6464
&FetchEmailUser($EmailUserID);
6565

66-
my @Scripts = ("jquery/jquery-3.0.0.min","jquery/jquery.tablesorter.min","jquery/jquery.tablesorter.widgets");
66+
my @Scripts = ("jquery/jquery-3.5.1.slim.min","jquery/jquery.tablesorter.min","jquery/jquery.tablesorter.widgets");
6767
@JQueryElements = ("tablesorter");
6868
push @Scripts,"JQueryReady";
6969

‎DocDB/html/js/jquery/jquery-3.5.1.slim.min.js‎

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)