From a1d4f412181423cb3883650e033b9fb5b415bd83 Mon Sep 17 00:00:00 2001

From: Petr Vobornik <pvoborni@redhat.com>

Date: Mon, 10 Nov 2014 16:24:15 +0100

Subject: [PATCH] webui: fix potential XSS vulnerabilities

Escape user defined text to prevent XSS attacks. Extra precaution was taken

to escape also parts which are unlikely to contain user-defined text.

fixes CVE-2014-7850

https://fedorahosted.org/freeipa/ticket/4742

Reviewed-By: Tomas Babej <tbabej@redhat.com>

---

 install/ui/src/freeipa/Application_controller.js |  4 ++--

 install/ui/src/freeipa/facet.js                  | 12 +++++++-----

 install/ui/src/freeipa/ipa.js                    |  1 +

 install/ui/src/freeipa/rule.js                   |  2 +-

 install/ui/src/freeipa/widget.js                 |  4 ++--

 5 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/install/ui/src/freeipa/Application_controller.js b/install/ui/src/freeipa/Application_controller.js

index 094bd3da7c4806a316ebe2589b98a523410f4a5f..4bf76f8f56a8e34e330c35956b8922cc3c8f79e3 100644

--- a/install/ui/src/freeipa/Application_controller.js

+++ b/install/ui/src/freeipa/Application_controller.js

@@ -252,12 +252,12 @@ define([

             var error_container = $('
', {

                 'class': 'container facet-content facet-error'

             }).appendTo($('.app-container .content').empty());

-            error_container.append('
'+name+'
');

+            error_container.append($('
', { text: name }));

             var details = $('
', {

                 'class': 'error-details'

             }).appendTo(error_container);

-            details.append('
 Web UI got in unrecoverable state during "'+error.phase+'" phase.
');

+            details.append($('
', { text: 'Web UI got in unrecoverable state during "' + error.phase + '" phase' }));

             if (error.name) window.console.error(error.name);

             if (error.results) {

                 var msg = error.results.message;

diff --git a/install/ui/src/freeipa/facet.js b/install/ui/src/freeipa/facet.js

index 43627d9d531ed700ff780a0773451eaf17b1cbdd..b0121c75fd584988883a3b5f7d1665a985a321fd 100644

--- a/install/ui/src/freeipa/facet.js

+++ b/install/ui/src/freeipa/facet.js

@@ -895,12 +895,12 @@ exp.facet = IPA.facet = function(spec, no_init) {

         title = title.replace('${error}', error_thrown.name);

         that.error_container.empty();

-        that.error_container.append('
'+title+'
');

+        that.error_container.append($('
', { text: title }));

         var details = $('
', {

             'class': 'error-details'

         }).appendTo(that.error_container);

-        details.append('
'+error_thrown.message+'
');

+        details.append($('
', { text: error_thrown.message }));

         $('
', {

             text: text.get('@i18n:error_report.options')

@@ -932,7 +932,9 @@ exp.facet = IPA.facet = function(spec, no_init) {

             }

         );

-        that.error_container.append('
'+text.get('@i18n:error_report.problem_persists')+'
');

+        that.error_container.append($('
', {

+            text: text.get('@i18n:error_report.problem_persists')

+        }));

         that.show_error();

     };

@@ -1214,7 +1216,7 @@ exp.facet_header = IPA.facet_header = function(spec) {

                 click: item.handler

             }).appendTo(bc_item);

         } else {

-            bc_item.append(item.text);

+            bc_item.text(item.text);

         }

         return bc_item;

     };

@@ -1823,7 +1825,7 @@ exp.table_facet = IPA.table_facet = function(spec, no_init) {

             function(xhr, text_status, error_thrown) {

                 that.load_records([]);

                 var summary = that.table.summary.empty();

-                summary.append(error_thrown.name+': '+error_thrown.message);

+                summary.text(error_thrown.name+': '+error_thrown.message);

             }

         );

     };

diff --git a/install/ui/src/freeipa/ipa.js b/install/ui/src/freeipa/ipa.js

index 6d3aeaaaaca11dfdaf20935e5c9084c9ed106e6c..137f11e832ff8d0b6dd1b50060f8537c7b117616 100644

--- a/install/ui/src/freeipa/ipa.js

+++ b/install/ui/src/freeipa/ipa.js

@@ -1133,6 +1133,7 @@ IPA.notify = function(message, type, timeout) {

     if (typeof message === 'string') {

         message = text.get(message);

+        message = document.createTextNode(message);

     }

     var notification_area = $('#notification .notification-area');

diff --git a/install/ui/src/freeipa/rule.js b/install/ui/src/freeipa/rule.js

index 8a2b01963b74e1892ac15127ae0050b35fe6ac27..706827190261efda136f6d1489bdb13543c00f7a 100644

--- a/install/ui/src/freeipa/rule.js

+++ b/install/ui/src/freeipa/rule.js

@@ -91,7 +91,7 @@ IPA.rule_radio_widget = function(spec) {

         var param_info = IPA.get_entity_param(that.entity.name, that.name);

         var title = param_info ? param_info.doc : that.name;

-        container.append(title + ': ');

+        container.append(document.createTextNode(title + ': '));

         that.widget_create(container);

         that.owb_create(container);

         if (that.undo) {

diff --git a/install/ui/src/freeipa/widget.js b/install/ui/src/freeipa/widget.js

index 9240df8ef5402310ec9ceafd0b766def10c8cb48..1ef1a2bf22b735edcfcca44cfc1e69bc8d36a740 100644

--- a/install/ui/src/freeipa/widget.js

+++ b/install/ui/src/freeipa/widget.js

@@ -4166,8 +4166,8 @@ IPA.link_widget = function(spec) {

         that.values = util.normalize_value(values);

         that.value = that.values.slice(-1)[0] || '';

-        that.link.html(that.value);

-        that.nonlink.html(that.value);

+        that.link.text(that.value);

+        that.nonlink.text(that.value);

         that.update_link();

         that.check_entity_link();

         that.on_value_changed(values);

-- 

2.1.0