ISFDB Bibliographic Tools / Bugs / #757 Regular search

#757 Regular search - XSS vulnerability

Milestone: v1.0 (example)

Status: closed-fixed

Owner: Ahasuerus

Labels: None

Priority: 5

Updated: 2020-11-20

Created: 2020-09-14

Creator: Dirk Stoecker

Private: No

There are multiple previously unreported XSS vulnerabilities on regular Search pages.

Discussion

summary: isfdb.org Cross Site Scripting vulnerability --> Regular search - XSS vulnerability
Description has changed:

Diff:

--- old
+++ new
@@ -1,35 +1 @@
-Yet unreported issue when passing HTML tags in search field.
-
-~~~
-Index: biblio/se.py
-===================================================================
---- biblio/se.py        (Revision 551)
-+++ biblio/se.py        (Arbeitskopie)
-@@ -41,7 +41,7 @@
-                 return (0, error)
- 
- def PrintSummary(arg, count, limit, search_type, search_abbreviation):
--        print &#34;&lt;p&gt;&lt;b&gt;A search for &#39;%s&#39; found %d matches&#34; % (arg, count)
-+        print &#34;&lt;p&gt;&lt;b&gt;A search for &#39;%s&#39; found %d matches&#34; % (cgi.escape(arg), count)
-         if count &gt;= limit:
-                print &#34;&lt;br&gt;The first %d matches are displayed below. &#34; % (limit)
-                print &#39;Use &lt;a class=&#34;inverted&#34; href=&#34;http:/%s/adv_search_selection.cgi?%s&#34;&gt;Advanced %s Search&lt;/a&gt;&#39; % (HTFAKE, search_abbreviation, search_type)
-@@ -57,7 +57,7 @@
-         print &#39;&lt;option VALUE=&#34;exact&#34;&gt;exact %s search&#39; % search_type
-         print &#39;&lt;option SELECTED VALUE=&#34;approximate&#34;&gt;approximate %s search&#39; % search_type
-        print &#39;&lt;/select&gt;&#39;
--        print &#39; on &lt;input NAME=&#34;SEARCH_VALUE&#34; SIZE=&#34;50&#34; VALUE=&#34;%s&#34;&gt;&#39; % arg
-+        print &#39; on &lt;input NAME=&#34;SEARCH_VALUE&#34; SIZE=&#34;50&#34; VALUE=&#34;%s&#34;&gt;&#39; % cgi.escape(arg)
-        print &#39;&lt;input NAME=&#34;PAGE_TYPE&#34; VALUE=&#34;%s&#34; TYPE=&#34;HIDDEN&#34;&gt;&#39; % search_type
-        print &#39;&lt;input TYPE=&#34;SUBMIT&#34; VALUE=&#34;using Google&#34;&gt;&#39;
-        print &#39;&lt;/form&gt;&#39;
-@@ -454,6 +454,5 @@
-         else:
-                 DoError(&#39;No search value specified&#39;, search_value, type)
- 
--       print &#39;&lt;p&gt;&#39;
-        PrintTrailer(&#39;search&#39;, 0, 0)
-
-~~~
-
-NOTE: The removed print fixes an HTML issue and is not directly related to the CSS issue.
+There are multiple previously  unreported XSS vulnerabilities on regular Search pages.

assigned_to: Ahasuerus

Anonymous

Add attachments
Cancel
You seem to have CSS turned off. Please don't fill out this field.

You seem to have CSS turned off. Please don't fill out this field.

Ahasuerus - 2020-11-20

status: open --> closed-fixed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Anonymous
  
  Add attachments
  Cancel
  You seem to have CSS turned off. Please don't fill out this field.
  
  You seem to have CSS turned off. Please don't fill out this field.

Ahasuerus - 2020-11-20

Fixed in:

biblio/se.py common/navbar.py

Installed in SVN 574 on 2020-11-20. Closing the Bug.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Anonymous
  
  Add attachments
  Cancel
  You seem to have CSS turned off. Please don't fill out this field.
  
  You seem to have CSS turned off. Please don't fill out this field.

Anonymous

Regular search - XSS vulnerability

Group

Searches

Help

#757 Regular search - XSS vulnerability

Discussion