浏览代码

[core] Fix XSS vulnerabilities of jHueNotify and UserAdmin

Enrico Berti 10 年之前
父节点
当前提交
d3644daf33

+ 7 - 6
apps/useradmin/src/useradmin/templates/list_groups.mako

@@ -14,11 +14,12 @@
 ## See the License for the specific language governing permissions and
 ## limitations under the License.
 <%!
-from desktop.views import commonheader, commonfooter
+from desktop.views import commonheader, commonfooter, antixss
 from django.utils.translation import ugettext as _
 from useradmin.models import group_permissions
 %>
 
+
 <%namespace name="actionbar" file="actionbar.mako" />
 <%namespace name="layout" file="layout.mako" />
 ${ commonheader(_('Hue Groups'), "useradmin", user) | n,unicode }
@@ -116,7 +117,7 @@ ${layout.menubar(section='groups')}
       <input type="submit" class="btn btn-danger" value="${_('Yes')}"/>
     </div>
     <div class="hide">
-      <select name="group_names" data-bind="options: availableUsers, selectedOptions: chosenUsers" multiple="true"></select>
+      <select name="group_names" data-bind="options: availableGroups, selectedOptions: chosenGroups" multiple="true"></select>
     </div>
   </form>
 </div>
@@ -128,8 +129,8 @@ ${layout.menubar(section='groups')}
 
   $(document).ready(function () {
     viewModel = {
-      availableUsers: ko.observableArray(${ groups_json | n }),
-      chosenUsers: ko.observableArray([])
+      availableGroups: ko.observableArray(${ groups_json | n,antixss }),
+      chosenGroups: ko.observableArray([])
     };
 
     ko.applyBindings(viewModel);
@@ -189,10 +190,10 @@ ${layout.menubar(section='groups')}
     }
 
     $("#deleteGroupBtn").click(function () {
-      viewModel.chosenUsers.removeAll();
+      viewModel.chosenGroups.removeAll();
 
       $(".hueCheckbox[checked='checked']").each(function (index) {
-        viewModel.chosenUsers.push($(this).data("name").toString()); // needed for numeric group names
+        viewModel.chosenGroups.push($(this).data("name").toString()); // needed for numeric group names
       });
 
       $("#deleteGroup").modal("show");

+ 2 - 2
apps/useradmin/src/useradmin/templates/list_users.mako

@@ -14,7 +14,7 @@
 ## See the License for the specific language governing permissions and
 ## limitations under the License.
 <%!
-from desktop.views import commonheader, commonfooter
+from desktop.views import commonheader, commonfooter, antixss
 from django.template.defaultfilters import date, time
 from django.utils.translation import ugettext as _
 %>
@@ -143,7 +143,7 @@ ${layout.menubar(section='users')}
 <script type="text/javascript" charset="utf-8">
   $(document).ready(function () {
     var viewModel = {
-      availableUsers: ko.observableArray(${ users_json | n }),
+      availableUsers: ko.observableArray(${ users_json | n,antixss }),
       chosenUsers: ko.observableArray([])
     };
 

+ 1 - 1
desktop/core/src/desktop/static/desktop/js/jquery.notify.js

@@ -48,7 +48,7 @@
     var _this = this;
     var MARGIN = 10;
 
-    _this.options.message = $("<span>").html(_this.options.message).text(); // escape HTML messages
+    _this.options.message = $("<span>").text(_this.options.message).html(); // escape HTML messages
 
     if (_this.options.level == TYPES.ERROR && $(".jHueNotify.alert-error").length > 0) {
       $(".jHueNotify.alert-error").find(".message").html("<i class='fa fa-exclamation-triangle'></i> <strong>" + _this.options.message + "</strong>");

+ 5 - 0
desktop/core/src/desktop/views.py

@@ -491,3 +491,8 @@ def check_config_ajax(request):
 # This is a global non-view for inline KO i18n
 def _ko(str=""):
   return _(str).replace("'", "\\'")
+
+# This global Mako filtering option, use it with ${ yourvalue | n,antixss }
+def antixss(value):
+  xss_regex = re.compile(r'<[^>]+>')
+  return xss_regex.sub('', value)