Module: check_mk
Branch: master
Commit: 4de133ace84152390d5bba18e7997ebdfa5c7c8a
URL:
http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=4de133ace84152…
Author: Lars Michelsen <lm(a)mathias-kettner.de>
Date: Wed Jan 10 16:20:10 2018 +0100
5632 SEC Fixed XSS when rendering values of dropdown choices
When using the WATO configuration it was possible to create e.g.
a service level definition with javascript code in it's alias. When
this definition was configured in a rule of the ruleset
"Service Level of Hosts", the javascript code could be executed in the
browsers context of the user viewing the rule.
The insertion of the javascript code is only possible for authenticated
users with the permission to configure Check_MK.
Change-Id: I968949787a22c30b63bcf3f4cf18a9a921d40770
---
.werks/5632 | 18 ++++++++++++++++++
web/htdocs/valuespec.py | 4 ++--
2 files changed, 20 insertions(+), 2 deletions(-)
diff --git a/.werks/5632 b/.werks/5632
new file mode 100644
index 0000000..e1d57c8
--- /dev/null
+++ b/.werks/5632
@@ -0,0 +1,18 @@
+Title: Fixed XSS when rendering values of dropdown choices
+Level: 1
+Component: multisite
+Class: security
+Compatible: compat
+Edition: cre
+State: unknown
+Version: 1.5.0i3
+Date: 1515597400
+
+When using the WATO configuration it was possible to create e.g.
+a service level definition with javascript code in it's alias. When
+this definition was configured in a rule of the ruleset
+"Service Level of Hosts", the javascript code could be executed in the
+browsers context of the user viewing the rule.
+
+The insertion of the javascript code is only possible for authenticated
+users with the permission to configure Check_MK.
diff --git a/web/htdocs/valuespec.py b/web/htdocs/valuespec.py
index 63f91c3..c444209 100644
--- a/web/htdocs/valuespec.py
+++ b/web/htdocs/valuespec.py
@@ -1619,9 +1619,9 @@ class DropdownChoice(ValueSpec):
val, title = entry[:2]
if value == val:
if self._help_separator:
- return title.split(self._help_separator, 1)[0].strip()
+ return html.attrencode(title.split(self._help_separator,
1)[0].strip())
else:
- return title
+ return html.attrencode(title)
return html.attrencode(self._get_invalid_choice_title(value))