LP1757526 Escape displayed catalogue data

Content in content fields (5xx) as well as for the names of locations in copy
count alt text was not being properly escaped, allowing for the possibility of
executing arbitrary JavaScript in the case of a malicious catalogue record
(whether edited in the system, or imported)

Signed-off-by: Dan Scott <dscott@laurentian.ca>
Signed-off-by: Chris Sharp <csharp@georgialibraries.org>
Signed-off-by: Galen Charlton <gmc@equinoxinitiative.org>

diff --git a/Open-ILS/src/templates/opac/parts/record/contents.tt2 b/Open-ILS/src/templates/opac/parts/record/contents.tt2
index 87057dc..db80b47 100644 (file)
--- a/Open-ILS/src/templates/opac/parts/record/contents.tt2
+++ b/Open-ILS/src/templates/opac/parts/record/contents.tt2
@@ -177,8 +177,7 @@ BLOCK render_contents;
             all_content.push(subfield.textContent);
         END;
         total_contents = all_content.join(" ").replace('\s+$', '');
-        %] [% total_contents;
-        IF total_contents.size; "<br/>"; END;
+        %] [% "<div class='content_field'>"; total_contents | html ; "</div>";
         FOREACH link880 IN graphics;
             '<div class="graphic880"' _ link880.dir _ '>';
             link880.value | html;

diff --git a/Open-ILS/src/templates/opac/parts/record/copy_counts.tt2 b/Open-ILS/src/templates/opac/parts/record/copy_counts.tt2
index eee85e8..e6e783f 100644 (file)
--- a/Open-ILS/src/templates/opac/parts/record/copy_counts.tt2
+++ b/Open-ILS/src/templates/opac/parts/record/copy_counts.tt2
@@ -23,7 +23,7 @@
     [%- this_depth = ctx.get_aou(ou_id).ou_type.depth;
         IF ou_count > 0 && this_depth != ctx.copy_depth %]
     <a href="[% mkurl('', {copy_depth => this_depth}, ['copy_offset']); %]"
-       title="[% l('Show copies at [_1]', ou_name); %]">
+       title="[% l('Show copies at [_1]', ou_name) | html; %]">
        [%- l('(Show)'); %]</a>
     [%- END; %]
     </li>
@@ -43,7 +43,7 @@
             attrs.plib_copy_counts.$depth.count,
             ou_name) | html
     %] <a href="[% mkurl('', {locg => ou_id}, ['copy_offset']); %]"
-       title="[% l('Show copies at [_1]', ou_name); %]">[%
+       title="[% l('Show copies at [_1]', ou_name) | html; %]">[%
        l('(Show preferred library)');
     %]</a></li>
     [%- END %]