Browse Source

HUE-6856 [search] Protect against reflected XSS in search query parameters

Romain Rigaux 8 years ago
parent
commit
37b529b

+ 9 - 0
desktop/libs/dashboard/src/dashboard/tests.py

@@ -507,6 +507,15 @@ class TestWithMockedSolr(TestSearchBase):
     assert_equal('application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', xls_response['Content-Type'])
     assert_equal('attachment; filename=query_result.xlsx', xls_response['Content-Disposition'])
 
+  def test_index_xss(self):
+    doc = Document2.objects.create(name='test_dashboard', type='search-dashboard', owner=self.user,
+                                   data=json.dumps(self.collection.data), parent_directory=self.home_dir)
+    try:
+      response = self.c.get(reverse('dashboard:index') + ('?collection=%s' % doc.id) + '&q=</script><script>alert(%27XSS%27)</script>')
+      assert_equal('{"fqs": [], "qs": [{"q": "alert(\'XSS\')"}], "start": 0}', response.context['query'])
+    finally:
+      doc.delete()
+
   def test_augment_response(self):
     collection = self._get_collection_param(self.collection)
     query = QUERY

+ 4 - 3
desktop/libs/dashboard/src/dashboard/views.py

@@ -26,6 +26,7 @@ from desktop.conf import USE_NEW_EDITOR
 from desktop.lib.django_util import JsonResponse, render
 from desktop.lib.exceptions_renderable import PopupException
 from desktop.models import Document2, Document
+from desktop.views import antixss
 
 from search.conf import LATEST
 
@@ -72,9 +73,9 @@ def index(request, is_mobile=False):
 
   if request.method == 'GET':
     if 'q' in request.GET:
-      query['qs'][0]['q'] = request.GET.get('q')
+      query['qs'][0]['q'] = antixss(request.GET.get('q', ''))
     if 'qd' in request.GET:
-      query['qd'] = request.GET.get('qd')
+      query['qd'] = antixss(request.GET.get('qd', ''))
 
   template = 'search.mako'
   if is_mobile:
@@ -89,7 +90,7 @@ def index(request, is_mobile=False):
         'is_latest': LATEST.get(),
         'engines': get_engines(request.user)
     }),
-    'is_owner': collection_doc.doc.get().can_write(request.user),
+    'is_owner': collection_doc.can_write(request.user) if USE_NEW_EDITOR.get() else collection_doc.doc.get().can_write(request.user),
     'can_edit_index': can_edit_index(request.user),
     'is_embeddable': request.GET.get('is_embeddable', False),
     'mobile': is_mobile,