Bladeren bron

HUE-5339 [search] Multivalued data can include js XSS injection

Romain Rigaux 9 jaren geleden
bovenliggende
commit
9efb39f
2 gewijzigde bestanden met toevoegingen van 3 en 3 verwijderingen
  1. 1 1
      apps/search/src/search/models.py
  2. 2 2
      apps/search/src/search/tests.py

+ 1 - 1
apps/search/src/search/models.py

@@ -884,7 +884,7 @@ def augment_solr_response(response, collection, query):
         elif field == '_childDocuments_': # Nested documents
           escaped_value = value
         elif isinstance(value, list): # Multivalue field
-          escaped_value = [smart_unicode(val, errors='replace') for val in value]
+          escaped_value = [smart_unicode(escape(val), errors='replace') for val in value]
         else:
           value = smart_unicode(value, errors='replace')
           escaped_value = escape(value)

+ 2 - 2
apps/search/src/search/tests.py

@@ -253,7 +253,7 @@ class TestWithMockedSolr(TestSearchBase):
             "title": [
               "val1",
               "val2",
-              "[val3]",
+              "[<script>alert(123)</script>]",
               "val4"
             ],
             "_version_": 1513046095083602000
@@ -269,7 +269,7 @@ class TestWithMockedSolr(TestSearchBase):
 
     result = json.loads(response.content)
     assert_equal(
-        [{'hueId': 'change.me', 'id': 'change.me', '_version_': 1513046095083602000, 'title': ['val1', 'val2', '[val3]', 'val4'], 'details': [], 'externalLink': None}],
+        [{'hueId': 'change.me', 'id': 'change.me', '_version_': 1513046095083602000, 'title': ['val1', 'val2', '[&lt;script&gt;alert(123)&lt;/script&gt;]', 'val4'], 'details': [], 'externalLink': None}],
         result['response']['docs']
     )