Project: Birt
Bug 336767 Security Issue in BIRT Viewer
Reported: 2011-02-09 16:39:46 | Status: verified fixed

As pointed out by Jeff Beard-Shouse from Security PS, the viewer contains a security bug. Currently the user of the viewer can enter a URL Parameter for the report name. This parameter can be a URL for a report. This could allow a malicious user to specify a report design that contains JavaScript to be executed on the server running the viewer. To work around this I suggest adding the following web.xml setting: <context-param> <param-name>BIRT_VIEWER_URL_REPORT</param-name> <param-value>domain</param-value> </context-param> Valid values would be true, false, and domain. If the value is set to false or is set to any other value than true or domain the report would not be executed. If the value is set to true, no check is made and the server administrator assumes the risk. If the value is set to domain, the url of the report design is checked and compared to the host currently running the viewer. If they match the report will execute. This change would require adding the following to ParameterAccessor.java public static final String INIT_BIRT_VIEWER_URL_REPORT = "BIRT_VIEWER_URL_REPORT" and the getReport method in the same class could be changed to the following: public static String getReport( HttpServletRequest request, String filePath ) { String check_url_support = getInitProp("INIT_BIRT_VIEWER_URL_REPORT"); if ( filePath == null ) { filePath = DataUtil.trimString( getParameter( request, PARAM_REPORT ) ); } filePath = decodeFilePath( request, filePath ); //may need to add ftp? if ((filePath.split("http://").length > 1)||(filePath.split("https://").length > 1)) { String dm = request.getServerName(); if( check_url_support == null || (check_url_support.compareToIgnoreCase("false") == 0)){ return("urls not supported or"); } if( check_url_support.compareToIgnoreCase("domain") == 0 || check_url_support.compareToIgnoreCase("true") == 0){ URL rpturl; try { rpturl = new URL(filePath); if( rpturl.getHost().compareTo(dm)==0 || check_url_support.compareToIgnoreCase("true") == 0){ return filePath; }else{ return("urls not supported or"); } } catch (MalformedURLException e) { } } } return getRealPathOnWorkingFolder( filePath, request ); }

Files changed in fix:
viewer/org.eclipse.birt.report.viewer/birt/WEB-INF/classes/org/eclipse/birt/report/context/ViewerAttributeBean.java viewer/org.eclipse.birt.report.viewer/birt/WEB-INF/classes/org/eclipse/birt/report/taglib/util/BirtTagUtil.java viewer/org.eclipse.birt.report.viewer/birt/WEB-INF/classes/org/eclipse/birt/report/utility/ParameterAccessor.java