da888bc1a9
- Resolves: bz1165674 - Resolves: bz1165856 (CVE-2014-7850) - Fixes DNS install issue that prevents the server from working
132 lines
5.7 KiB
Diff
132 lines
5.7 KiB
Diff
From af9fd4dfe2c18e52127480c959c35ad37b566095 Mon Sep 17 00:00:00 2001
|
|
From: Petr Vobornik <pvoborni@redhat.com>
|
|
Date: Mon, 10 Nov 2014 16:24:15 +0100
|
|
Subject: [PATCH] webui: fix potential XSS vulnerabilities
|
|
|
|
Escape user defined text to prevent XSS attacks. Extra precaution was taken
|
|
to escape also parts which are unlikely to contain user-defined text.
|
|
|
|
fixes CVE-2014-7850
|
|
|
|
https://fedorahosted.org/freeipa/ticket/4742
|
|
|
|
Reviewed-By: Tomas Babej <tbabej@redhat.com>
|
|
---
|
|
install/ui/src/freeipa/Application_controller.js | 4 ++--
|
|
install/ui/src/freeipa/facet.js | 12 +++++++-----
|
|
install/ui/src/freeipa/ipa.js | 1 +
|
|
install/ui/src/freeipa/rule.js | 2 +-
|
|
install/ui/src/freeipa/widget.js | 4 ++--
|
|
5 files changed, 13 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/install/ui/src/freeipa/Application_controller.js b/install/ui/src/freeipa/Application_controller.js
|
|
index 094bd3da7c4806a316ebe2589b98a523410f4a5f..4bf76f8f56a8e34e330c35956b8922cc3c8f79e3 100644
|
|
--- a/install/ui/src/freeipa/Application_controller.js
|
|
+++ b/install/ui/src/freeipa/Application_controller.js
|
|
@@ -252,12 +252,12 @@ define([
|
|
var error_container = $('<div/>', {
|
|
'class': 'container facet-content facet-error'
|
|
}).appendTo($('.app-container .content').empty());
|
|
- error_container.append('<h1>'+name+'</h1>');
|
|
+ error_container.append($('<h1/>', { text: name }));
|
|
var details = $('<div/>', {
|
|
'class': 'error-details'
|
|
}).appendTo(error_container);
|
|
|
|
- details.append('<p> Web UI got in unrecoverable state during "'+error.phase+'" phase.</p>');
|
|
+ details.append($('<p/>', { text: 'Web UI got in unrecoverable state during "' + error.phase + '" phase' }));
|
|
if (error.name) window.console.error(error.name);
|
|
if (error.results) {
|
|
var msg = error.results.message;
|
|
diff --git a/install/ui/src/freeipa/facet.js b/install/ui/src/freeipa/facet.js
|
|
index 43627d9d531ed700ff780a0773451eaf17b1cbdd..b0121c75fd584988883a3b5f7d1665a985a321fd 100644
|
|
--- a/install/ui/src/freeipa/facet.js
|
|
+++ b/install/ui/src/freeipa/facet.js
|
|
@@ -895,12 +895,12 @@ exp.facet = IPA.facet = function(spec, no_init) {
|
|
title = title.replace('${error}', error_thrown.name);
|
|
|
|
that.error_container.empty();
|
|
- that.error_container.append('<h1>'+title+'</h1>');
|
|
+ that.error_container.append($('<h1/>', { text: title }));
|
|
|
|
var details = $('<div/>', {
|
|
'class': 'error-details'
|
|
}).appendTo(that.error_container);
|
|
- details.append('<p>'+error_thrown.message+'</p>');
|
|
+ details.append($('<p/>', { text: error_thrown.message }));
|
|
|
|
$('<div/>', {
|
|
text: text.get('@i18n:error_report.options')
|
|
@@ -932,7 +932,9 @@ exp.facet = IPA.facet = function(spec, no_init) {
|
|
}
|
|
);
|
|
|
|
- that.error_container.append('<p>'+text.get('@i18n:error_report.problem_persists')+'</p>');
|
|
+ that.error_container.append($('<p/>', {
|
|
+ text: text.get('@i18n:error_report.problem_persists')
|
|
+ }));
|
|
|
|
that.show_error();
|
|
};
|
|
@@ -1214,7 +1216,7 @@ exp.facet_header = IPA.facet_header = function(spec) {
|
|
click: item.handler
|
|
}).appendTo(bc_item);
|
|
} else {
|
|
- bc_item.append(item.text);
|
|
+ bc_item.text(item.text);
|
|
}
|
|
return bc_item;
|
|
};
|
|
@@ -1823,7 +1825,7 @@ exp.table_facet = IPA.table_facet = function(spec, no_init) {
|
|
function(xhr, text_status, error_thrown) {
|
|
that.load_records([]);
|
|
var summary = that.table.summary.empty();
|
|
- summary.append(error_thrown.name+': '+error_thrown.message);
|
|
+ summary.text(error_thrown.name+': '+error_thrown.message);
|
|
}
|
|
);
|
|
};
|
|
diff --git a/install/ui/src/freeipa/ipa.js b/install/ui/src/freeipa/ipa.js
|
|
index 6d3aeaaaaca11dfdaf20935e5c9084c9ed106e6c..137f11e832ff8d0b6dd1b50060f8537c7b117616 100644
|
|
--- a/install/ui/src/freeipa/ipa.js
|
|
+++ b/install/ui/src/freeipa/ipa.js
|
|
@@ -1133,6 +1133,7 @@ IPA.notify = function(message, type, timeout) {
|
|
|
|
if (typeof message === 'string') {
|
|
message = text.get(message);
|
|
+ message = document.createTextNode(message);
|
|
}
|
|
|
|
var notification_area = $('#notification .notification-area');
|
|
diff --git a/install/ui/src/freeipa/rule.js b/install/ui/src/freeipa/rule.js
|
|
index 8a2b01963b74e1892ac15127ae0050b35fe6ac27..706827190261efda136f6d1489bdb13543c00f7a 100644
|
|
--- a/install/ui/src/freeipa/rule.js
|
|
+++ b/install/ui/src/freeipa/rule.js
|
|
@@ -91,7 +91,7 @@ IPA.rule_radio_widget = function(spec) {
|
|
var param_info = IPA.get_entity_param(that.entity.name, that.name);
|
|
var title = param_info ? param_info.doc : that.name;
|
|
|
|
- container.append(title + ': ');
|
|
+ container.append(document.createTextNode(title + ': '));
|
|
that.widget_create(container);
|
|
that.owb_create(container);
|
|
if (that.undo) {
|
|
diff --git a/install/ui/src/freeipa/widget.js b/install/ui/src/freeipa/widget.js
|
|
index 9240df8ef5402310ec9ceafd0b766def10c8cb48..1ef1a2bf22b735edcfcca44cfc1e69bc8d36a740 100644
|
|
--- a/install/ui/src/freeipa/widget.js
|
|
+++ b/install/ui/src/freeipa/widget.js
|
|
@@ -4166,8 +4166,8 @@ IPA.link_widget = function(spec) {
|
|
|
|
that.values = util.normalize_value(values);
|
|
that.value = that.values.slice(-1)[0] || '';
|
|
- that.link.html(that.value);
|
|
- that.nonlink.html(that.value);
|
|
+ that.link.text(that.value);
|
|
+ that.nonlink.text(that.value);
|
|
that.update_link();
|
|
that.check_entity_link();
|
|
that.on_value_changed(values);
|
|
--
|
|
2.1.0
|
|
|