IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-25 08:21:05 -06:00
Code Issues Packages Projects Releases Wiki Activity

webui: fix potential XSS vulnerabilities

Browse Source 
Escape user defined text to prevent XSS attacks. Extra precaution was taken
to escape also parts which are unlikely to contain user-defined text.

fixes CVE-2014-7850

https://fedorahosted.org/freeipa/ticket/4742

Reviewed-By: Tomas Babej <tbabej@redhat.com>
This commit is contained in:
Petr Vobornik 2014-11-10 16:24:15 +01:00 committed by Tomas Babej
parent 43285b1fc3
commit bff97e8b2e
5 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
install/ui/src/freeipa/Application_controller.js
View File

@ -252,12 +252,12 @@ define([
var error_container = $('<div/>', {
'class': 'container facet-content facet-error'
}).appendTo($('.app-container .content').empty());
error_container.append('<h1>'+name+'</h1>');
error_container.append($('<h1/>', { text: name }));
var details = $('<div/>', {
'class': 'error-details'
}).appendTo(error_container);
details.append('<p> Web UI got in unrecoverable state during "'+error.phase+'" phase.</p>');
details.append($('<p/>', { text: 'Web UI got in unrecoverable state during "' + error.phase + '" phase' }));
if (error.name) window.console.error(error.name);
if (error.results) {
var msg = error.results.message;

12
install/ui/src/freeipa/facet.js
View File

@ -895,12 +895,12 @@ exp.facet = IPA.facet = function(spec, no_init) {
title = title.replace('${error}', error_thrown.name);
that.error_container.empty();
that.error_container.append('<h1>'+title+'</h1>');
that.error_container.append($('<h1/>', { text: title }));
var details = $('<div/>', {
'class': 'error-details'
}).appendTo(that.error_container);
details.append('<p>'+error_thrown.message+'</p>');
details.append($('<p/>', { text: error_thrown.message }));
$('<div/>', {
text: text.get('@i18n:error_report.options')
@ -932,7 +932,9 @@ exp.facet = IPA.facet = function(spec, no_init) {
}
);
that.error_container.append('<p>'+text.get('@i18n:error_report.problem_persists')+'</p>');
that.error_container.append($('<p/>', {
text: text.get('@i18n:error_report.problem_persists')
}));
that.show_error();
};
@ -1214,7 +1216,7 @@ exp.facet_header = IPA.facet_header = function(spec) {
click: item.handler
}).appendTo(bc_item);
} else {
bc_item.append(item.text);
bc_item.text(item.text);
}
return bc_item;
};
@ -1823,7 +1825,7 @@ exp.table_facet = IPA.table_facet = function(spec, no_init) {
function(xhr, text_status, error_thrown) {
that.load_records([]);
var summary = that.table.summary.empty();
summary.append(error_thrown.name+': '+error_thrown.message);
summary.text(error_thrown.name+': '+error_thrown.message);
}
);
};

1
install/ui/src/freeipa/ipa.js
View File

@ -1133,6 +1133,7 @@ IPA.notify = function(message, type, timeout) {
if (typeof message === 'string') {
message = text.get(message);
message = document.createTextNode(message);
}
var notification_area = $('#notification .notification-area');

2
install/ui/src/freeipa/rule.js
View File

@ -91,7 +91,7 @@ IPA.rule_radio_widget = function(spec) {
var param_info = IPA.get_entity_param(that.entity.name, that.name);
var title = param_info ? param_info.doc : that.name;
container.append(title + ': ');
container.append(document.createTextNode(title + ': '));
that.widget_create(container);
that.owb_create(container);
if (that.undo) {

4
install/ui/src/freeipa/widget.js
View File

@ -4166,8 +4166,8 @@ IPA.link_widget = function(spec) {
that.values = util.normalize_value(values);
that.value = that.values.slice(-1)[0] || '';
that.link.html(that.value);
that.nonlink.html(that.value);
that.link.text(that.value);
that.nonlink.text(that.value);
that.update_link();
that.check_entity_link();
that.on_value_changed(values);