468626 - (WH-1704994) XSS vulns on tiki-poll_results.php

Status: VERIFIED FIXED

(support.mozilla.org :: Knowledge Base Software, task)

Description

[Reed Loden [:reed]]

http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_asc=%22%20STYLE=%22background-image:%20x(a:whs())&vote_from_date=2008-09-15&vote_to_date=2008-11-14&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_asc=%22%20STYLE=%22background-image:%20x(a:whs())&vote_from_date=2008-09-22&vote_to_date=2008-11-21&maxRecords=30
https://support.mozilla.com/tiki-poll_results.php?scoresort_asc=%22%20STYLE=%22background-image:%20x(a:whs())&vote_from_date=2008-09-22&vote_to_date=2008-11-21&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_asc=%22%20STYLE=%22background-image:%20x(a:whs())&vote_from_date=2008-10-07&vote_to_date=2008-12-06&maxRecords=30

http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_desc=%22%20STYLE=%22background-image:%20x(a:whs())&vote_from_date=2008-09-15&vote_to_date=2008-11-14&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_desc=%22%20STYLE=%22background-image:%20x(a:whs())&vote_from_date=2008-09-22&vote_to_date=2008-11-21&maxRecords=30
https://support.mozilla.com/tiki-poll_results.php?scoresort_desc=%22%20STYLE=%22background-image:%20x(a:whs())&vote_from_date=2008-09-22&vote_to_date=2008-11-21&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_desc=%22%20STYLE=%22background-image:%20x(a:whs())&vote_from_date=2008-10-07&vote_to_date=2008-12-06&maxRecords=30

http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_desc=4&vote_from_date=%22%20STYLE=%22background-image:%20x(a:whs())&vote_to_date=2008-11-14&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_asc=4&vote_from_date=%22%20STYLE=%22background-image:%20x(a:whs())&vote_to_date=2008-11-14&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_asc=4&vote_from_date=%22%20STYLE=%22background-image:%20x(a:whs())&vote_to_date=2008-11-21&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_desc=4&vote_from_date=%22%20STYLE=%22background-image:%20x(a:whs())&vote_to_date=2008-11-21&maxRecords=30
https://support.mozilla.com/tiki-poll_results.php?scoresort_desc=0&vote_from_date=%22%20STYLE=%22background-image:%20x(a:whs())&vote_to_date=2008-11-21&maxRecords=30

http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_asc=4&vote_from_date=2008-09-15&vote_to_date=%22%20STYLE=%22background-image:%20x(a:whs())&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_desc=4&vote_from_date=2008-09-15&vote_to_date=%22%20STYLE=%22background-image:%20x(a:whs())&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_asc=4&vote_from_date=2008-09-22&vote_to_date=%22%20STYLE=%22background-image:%20x(a:whs())&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_desc=4&vote_from_date=2008-09-22&vote_to_date=%22%20STYLE=%22background-image:%20x(a:whs())&maxRecords=30
https://support.mozilla.com/tiki-poll_results.php?scoresort_desc=0&vote_from_date=2008-09-22&vote_to_date=%22%20STYLE=%22background-image:%20x(a:whs())&maxRecords=30

https://support.mozilla.com/tiki-poll_results.php?scoresort_asc=4&vote_from_date=%22%20STYLE=%22background-image:%20x(a:whs())&vote_to_date=2008-11-21&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_desc=4&vote_from_date=%22%20STYLE=%22background-image:%20x(a:whs())&vote_to_date=2008-12-06&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_asc=4&vote_from_date=%22%20STYLE=%22background-image:%20x(a:whs())&vote_to_date=2008-12-06&maxRecords=30

https://support.mozilla.com/tiki-poll_results.php?scoresort_asc=4&vote_from_date=2008-09-22&vote_to_date=%22%20STYLE=%22background-image:%20x(a:whs())&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_desc=4&vote_from_date=2008-10-07&vote_to_date=%22%20STYLE=%22background-image:%20x(a:whs())&maxRecords=30
http://support.mozilla.com/tiki-poll_results.php?locale=en-US&scoresort_asc=4&vote_from_date=2008-10-07&vote_to_date=%22%20STYLE=%22background-image:%20x(a:whs())&maxRecords=30

Comment 1

[E. Cooper [:ecooper]]

Attachment: Escapes various params passed to tiki-poll_results.php

Comment 2

[Laura Thomson :laura]

In trunk r21585, prod r21586.

Comment 3

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED on staging.

Comment 4

[Reed Loden [:reed]]

So close!

One more to go:

http://support.mozilla.com/tiki-poll_results.php?pollId=%22whscheck=%22whscheck()

Comment 5

[E. Cooper [:ecooper]]

Attachment: Escapes pollId

Jeez. 

I wonder if it'd be better to just add some code to Smarty::assign (probably in webroot/setup_smarty.php) to escape outputs unless specified otherwise. At least then all the sanitizing would take place at the same layer and save us a bunch of XSS headaches.

Then again, at this point, we'd need to refactor a lot of smarty code to prevent double-escapes.

Comment 6

[Laura Thomson :laura]

Greenfields, this would be the right way to do it.  However, some issues:
1. We have no tests to spot regressions.
2. I'm fairly sure that this would cost a lot of time and effort in testing, QA, and just recoding.  Would most likely need doing in a new branch.
3. The reason Smarty supports different types of escaping is that output needs to be escaped differently depending on where it's going.  This will mean in places we'll end up unescaping and re-escaping appropriately.  It's a similar problem to turning on magic quotes.

So, given that I think we've closed off the WH vectors (bar one), the right way to proceed is:
- Start writing tests (needs doing anyway)
- Sometime, when we have time - which won't be this quarter, we are already behind - make a branch and experiment with making a global change to see how much stuff breaks.

Comment 7

[E. Cooper [:ecooper]]

In r21982 / r21984

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

Attachment: Screenshot

Is this fixed, per the screenshot?

Comment 9

[Laura Thomson :laura]

Can't tell from screenshot but view source says yes (please confirm).

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #9)
> Can't tell from screenshot but view source says yes (please confirm).

Sorry, yeah; now I remember:

staging: <input type="hidden" name="pollId" value="&quot;whscheck=&quot;whscheck()"/>

prod: <input type="hidden" name="pollId" value=""whscheck="whscheck()"/>

Verified FIXED.

Comment 11

[Yvan Boily [:ygjb][:yvan]]

Adding keywords to bugs for metrics, no action required.  Sorry about bugmail spam.

Comment 12

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.