[Bug 25373] New: Bug 23290 Security fix break all XSLT entities
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 Bug ID: 25373 Summary: Bug 23290 Security fix break all XSLT entities Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: minor Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: didier.gautheron@biblibre.com QA Contact: testopia@bugs.koha-community.org By default display XSL have : <!DOCTYPE stylesheet [<!ENTITY nbsp " " >]> Since Bug 23290 are replaced with nothing, mangling xsl style sheet output. Worse if nbsp is inside a xslt:text tag some (all?) xml parsers return an error with an empty output. Error: xsltParseTemplateContent: xslt:text content problem compilation error: file /home/koha/webdatas/public/XSLT/OPACResults.xsl element text xsltParseTemplateContent: xslt:text content problem at /home/koha/src/Koha/XSLT_Handler.pm line 343. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 didier <didier.gautheron@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |23290 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23290 [Bug 23290] XSLT system preferences allow administrators to exploit XML and XSLT vulnerabilities -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jonathan.druart@bugs.koha-c | |ommunity.org --- Comment #1 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- How do we recreate the problem? I do see the detail and result page, using the XSLTs. Default result XSLT file is: koha-tmpl/intranet-tmpl/prog/en/xslt/MARC21slim2intranetResults.xsl:<!DOCTYPE stylesheet [<!ENTITY nbsp " " >]> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 --- Comment #2 from didier <didier.gautheron@biblibre.com> --- Created attachment 104353 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=104353&action=edit XSLT patch with entity silently discarded -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 --- Comment #3 from didier <didier.gautheron@biblibre.com> --- Created attachment 104354 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=104354&action=edit XSLT patch with parser error -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 --- Comment #4 from didier <didier.gautheron@biblibre.com> --- Out of the box XSLT are fine, but upgrading Koha on a site with modified ones aren't, and because ENTITY is defined by default it's often used: Attached patches tested on 2020-05-05 master, Debian strech (it's a koha-testing-docker box) patch bad_output.txt: Online access: ---> Onlineaccess: no_output.txt: xsl parser error if notices have other title fields. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dcook@prosentient.com.au --- Comment #5 from David Cook <dcook@prosentient.com.au> --- I think that I understand. Koha's XSLTS define <!ENTITY nbsp " " >, but the entity is *not* actually used by any Koha XSLTs. It seems like Didier uses the in custom spreadsheets, and that causes the problem. It seems to me that this is not a Koha issue. Rather, Didier should stop using the entity. I'll open a report to remove the ENTITY declaration in the XSLTs, since it's unusable (and even problematic as Didier highlights) now. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 --- Comment #6 from David Cook <dcook@prosentient.com.au> --- Actually, Didier, what OS are you using and which XML parser? If I recall correctly, the default XML parser in Debian should never have expanded entities even before Bug 23290. I'm guessing you're not using defaults? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=25381 -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Bug 23290 Security fix | entity usage no |break all XSLT entities |longer works in custom | |XSLTs -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 --- Comment #7 from didier <didier.gautheron@biblibre.com> --- (In reply to David Cook from comment #6)
Actually, Didier, what OS are you using and which XML parser?
If I recall correctly, the default XML parser in Debian should never have expanded entities even before Bug 23290. I'm guessing you're not using defaults?
As far as I know plain Debian and Ubuntu. Adding unsafe works: <koha_xslt_security> <expand_entities_unsafe>1</expand_entities_unsafe> <koha_xslt_security> Or with 18.11 (prior commit Bug 23290) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 --- Comment #8 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Yes but it's not recommended, then you are vulnerable to what is described in bug 23290. The easiest seems to replace nsbp in your xsl files. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 --- Comment #9 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #8)
Yes but it's not recommended, then you are vulnerable to what is described in bug 23290. The easiest seems to replace nsbp in your xsl files.
I agree with Jonathan. I'd recommend not expanding entities as you'll create a security vulnerability in your installation. Just use directly instead of . -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 --- Comment #10 from David Cook <dcook@prosentient.com.au> --- I'd argue that we should mark this as "WON'T FIX". -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 --- Comment #11 from didier <didier.gautheron@biblibre.com> --- (In reply to David Cook from comment #9)
(In reply to Jonathan Druart from comment #8)
Yes but it's not recommended, then you are vulnerable to what is described in bug 23290. The easiest seems to replace nsbp in your xsl files.
I agree with Jonathan. I'd recommend not expanding entities as you'll create a security vulnerability in your installation. Just use directly instead of .
Hi, WON'T FIX make sense. Are you going to remove ENTITY in xls or should I make a report? Removing [<!ENTITY nbsp " " >] and using will do for us, thanks. No authority on XSTL files, libraries change them, moreover in french typography you add a space before many punctuation marks, like colon. Cf. (broken!) Koha french manual translation. https://koha-community.org/manual/18.05/fr/html/systempreferences.html BTW where do we fix this one? It's an eyesore :) Regards Didier -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 --- Comment #12 from David Cook <dcook@prosentient.com.au> --- (In reply to didier from comment #11)
Hi, WON'T FIX make sense.
Are you going to remove ENTITY in xls or should I make a report?
I've already reported it as Bug 25381. I'm rather busy at the moment, so it would be great if someone else wrote the batch, but if they don't I will eventually.
Removing [<!ENTITY nbsp " " >] and using will do for us, thanks.
Perfect :)
No authority on XSTL files, libraries change them, moreover in french typography you add a space before many punctuation marks, like colon. Cf. (broken!) Koha french manual translation. https://koha-community.org/manual/18.05/fr/html/systempreferences.html
Ah, that's interesting. It's been many years since I've had to write in French, so I must have forgotten if I ever knew that heh.
BTW where do we fix this one? It's an eyesore :)
Honestly, I'm not 100% sure. I think the git repo can be viewed at http://git.koha-community.org/gitweb/?p=kohadocs.git;a=summary. It looks like this might be the translation file needed to change: http://git.koha-community.org/gitweb/?p=kohadocs.git;a=blob;f=locales/fr/LC_... I think you can use that git repo, and then open a "Documentation" issue on this Bugzilla. I think Caroline Cyr La Rose from inLibro might be the expert on that one these days. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=25373 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |WONTFIX Status|NEW |RESOLVED -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org