https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19121 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |chris@bigballofwax.co.nz --- Comment #9 from Chris Cormack <chris@bigballofwax.co.nz> --- (In reply to Jonathan Druart from comment #7)
Hi Robin,
Thanks for your input!
I have to admit that I should have explained what I have in mind a bit more. At the moment we are facing lot of XSS vulnerabilities caused by input parameters we sent to the template: $template->param( foo => scalar $cgi->param('foo') ) and them [% foo %]
That is our main problem.
Of course the idea was not to insert escaped strings into the DB, but to trust data from DB (inserted from staff, not OPAC), and not url parameters. Which is wrong (!) and just move the escape problem to somewhere else (we will have to list the variable we trust and the ones we do not). I am obsoleting my proposal.
Fixing XSS incrementally scared me. First it will be long and hard to be exhaustive, then we will not be regression proof.
This won't save us from stored XSS either, I think scripting adding the |something to all non filtered output and changing the ones we don't want is probably the safest way to go. Long and annoying, but in the end easy to test for with QA scripts. -- You are receiving this mail because: You are watching all bug changes.