1663403 - searchengine-devtools has XSS vulnerabilities in configuration handling

Status: RESOLVED FIXED

(Firefox :: Search, defect, P2)

Description

[Mark Banner (:standard8)]

This is a follow-up to bug 1660282. That bug has stopped the XSS for the display of various elements on the UI, but we still need to sanitise / check the configuration before we pass it to the back-end and use it.

I have a few ideas on how to do that, will hopefully get time to look later this week.

Comment 1

[Mark Banner (:standard8)]

I hope to get to this soon, but no guarantees at the moment.

Comment 2

[Andreas Wagner [:TheOne] [use NI]]

I would appreciate if we could address this soon. Originally, the previous version was approved under the agreement that this gets fixed within 1 week. It's been more than 8 weeks now.

Comment 3

[Mark Banner (:standard8)]

Andreas, please can you take a look at this PR I'm working on:

https://github.com/mozilla-extensions/searchengine-devtools/pull/25/files

The basic idea is to use ajv to create a validation function based on the schema, and then use that validation on the loaded configurations.
Unfortunately due to the way ajv works, we have to webpack the validation function.

At the moment the schema is mainly validating the types of fields rather than the content, if this general method looks alright to you, then I'll update the schema to add more in-depth validation of the contents of the fields.

Comment 4

[Andreas Wagner [:TheOne] [use NI]]

This looks good to me! Thank you for working on it, Mark!

Comment 5

[Mark Banner (:standard8)]

PR is now ready: https://github.com/mozilla-extensions/searchengine-devtools/pull/25

Once we've landed that I'll also update the copies of the schemas from in-tree & on the remote settings servers.

Comment 6

[Dale Harvey (:daleharvey)]

Reviewed

Comment 7

[Mark Banner (:standard8)]

Andreas, this is now on ship-it and ready for release as 1.1.6.

Comment 8

[Andreas Wagner [:TheOne] [use NI]]

Thanks, I signed off.

Comment 9

[Mark Banner (:standard8)]

Thank you, this is now fully released.