Subject: security bug (with patch-fix) -- need more HTML-escaping for working with tree-nodes

From: Andrei Antonov <[email-masked]>
Date: Tue, 09 May 2017 22:36:48 +0300

good day!

i fixed tiny errors (html-escaping) , but it has security effects.

see file 
"0001-escape-label-of-node-of-tree-when-events-add-remove-.patch" [ 
https://github.com/postgres-impulsm/pgadmin4/commit/f993513d148fc6dd7e0196261f847e668d5e2c6c 
]

-- 
Андрей Антонов,
инженер-программист Отдела информационных технологий и программирования,
компания «Импульс М»

From f993513d148fc6dd7e0196261f847e668d5e2c6c Mon Sep 17 00:00:00 2001
From: Andrei Antonov <[email-masked]>
Date: Tue, 9 May 2017 22:18:54 +0300
Subject: [PATCH] escape label of node of tree, when events: add\remove\unload

---
 web/pgadmin/browser/templates/browser/js/node.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/web/pgadmin/browser/templates/browser/js/node.js b/web/pgadmin/browser/templates/browser/js/node.js
index e337fec0..ff8bc09f 100644
--- a/web/pgadmin/browser/templates/browser/js/node.js
+++ b/web/pgadmin/browser/templates/browser/js/node.js
@@ -743,7 +743,7 @@ function($, _, S, pgAdmin, Menu, Backbone, Alertify, pgBrowser, Backform) {
           t.setLabel(
             pItem, {
               label: (
-                pData._label + ' <span>(' + pData.collection_count + ')</span>'
+                _.escape(pData._label) + ' <span>(' + pData.collection_count + ')</span>'
               )
             }
           );
@@ -821,7 +821,7 @@ function($, _, S, pgAdmin, Menu, Backbone, Alertify, pgBrowser, Backform) {
           t.setLabel(
             pItem, {
               label: (
-                pData._label + ' <span>(' + pData.collection_count + ')</span>'
+                _.escape(pData._label) + ' <span>(' + pData.collection_count + ')</span>'
               )
             }
           );
@@ -838,7 +838,7 @@ function($, _, S, pgAdmin, Menu, Backbone, Alertify, pgBrowser, Backform) {
         if (self.is_collection && 'collection_count' in data)
         {
           delete data.collection_count;
-          t.setLabel(item, {label: data._label});
+          t.setLabel(item, {label: _.escape(data._label)});
         }
       },
       refresh: function(cmd, i) {
-- 
2.12.2

-- 
Sent via pgadmin-hackers mailing list ([email-masked])
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgadmin-hackers

---

From: Ashesh Vashi <[email-masked]>
Date: Wed, 10 May 2017 13:26:51 +0530

Thanks.
Committed!

--

Thanks & Regards,

Ashesh Vashi
EnterpriseDB INDIA: Enterprise PostgreSQL Company
<http://www.enterprisedb.com>

*http://www.linkedin.com/in/asheshvashi*
<http://www.linkedin.com/in/asheshvashi>

2017-05-10 1:06 GMT+05:30 Andrei Antonov <[email-masked]>:

> see file "0001-escape-label-of-node-of-tree-when-events-add-remove-.patch"
> [ https://github.com/postgres-impulsm/pgadmin4/commit/f993513d
> 148fc6dd7e0196261f847e668d5e2c6c ]
>
>
>
>
> --
> Андрей Антонов,

---

From: Dave Page <[email-masked]>
Date: Wed, 10 May 2017 08:59:05 +0100

On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi <[email-masked]
> wrote:

> Committed!

I agree with the change from a preventative/safety perspective, though I'm
struggling to classify it as a security issue, given that collections are
always named by the code and not from user input.

Am I missing something?

-- 
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

---

From: Ashesh Vashi <[email-masked]>
Date: Wed, 10 May 2017 13:30:57 +0530

On Wed, May 10, 2017 at 1:29 PM, Dave Page <[email-masked]> wrote:

>
>
> On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi <
> [email-masked]> wrote:
>
>> Thanks.
>> Committed!
>>
>
True - but not the case with the server-group.
It is a collection node, still has it's own label.

-- Thanks, Ashesh

---

From: Dave Page <[email-masked]>
Date: Wed, 10 May 2017 09:06:30 +0100

On Wed, May 10, 2017 at 9:00 AM, Ashesh Vashi <[email-masked]

>> I agree with the change from a preventative/safety perspective, though
>> I'm struggling to classify it as a security issue, given that collections
>> are always named by the code and not from user input.
>>
>> Am I missing something?
>>

Ahh, yes.

---

From: Dave Page <[email-masked]>
Date: Wed, 10 May 2017 09:35:58 +0100

BTW; Ashesh, can you please ensure there's an RM ticket for this, as it's
obviously of interest to users.

Thanks.

On Wed, May 10, 2017 at 9:06 AM, Dave Page <[email-masked]> wrote:

>
>
> On Wed, May 10, 2017 at 9:00 AM, Ashesh Vashi <

---

From: Ashesh Vashi <[email-masked]>
Date: Wed, 10 May 2017 14:17:42 +0530

Sure - I will create one.