CVE-2011-3591: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-12-26T02:59Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: JavaScript
Files changed: ChangeLog, js/functions.js, js/tbl_structure.js
Commit date: 2011-09-08 15:38:40 -0400
Commit message: Escape HTML in js-generated confirmation messages

Diff: diff --git a/ChangeLog b/ChangeLog
index 137616921..326c8c0ff 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -9,10 +9,12 @@ phpMyAdmin - ChangeLog
 - bug #3386434 [interface] Add missing space to server status
 - [core] Remove library PHPExcel, due to license issues
 - [export] Remove native Excel export modules (xls and xlsx formats)
 - [import] Remove native Excel import modules (xls and xlsx formats)
 - bug #3392920 [edit] BLOB emptied after editing another column
+- [security] Fixed XSS in Inline Edit on save action, see PMASA-2011-14
+- [security] Fixed XSS with db/table/column names, see PMASA-2011-14 
 
 3.4.4.0 (2011-08-24)
 - bug #3323060 [parser] SQL parser breaks AJAX requests if query has unclosed quotes
 - bug #3323101 [parser] Invalid escape sequence in SQL parser
 - bug #3348995 [config] $cfg['Export']['asfile'] set to false does not select asText option
@@ -29,11 +31,10 @@ phpMyAdmin - ChangeLog
 - bug #3374374 [interface] Fix footnote for inexact count while browsing
 - bug #3372807 [interface] Fix security warning link in setup
 - bug #3374347 [display] Backquotes in normal text on import page
 - bug #3358750 [core] With Suhosin, urls are too long in edit links
 - [security] Missing sanitization on the table, column and index names leads to XSS vulnerabilities, see PMASA-2011-13
-- [security] Fixed XSS in Inline Edit on save action
 
 3.4.3.2 (2011-07-23)
 - [security] Fixed XSS vulnerability, see PMASA-2011-9
 - [security] Fixed local file inclusion vulnerability, see PMASA-2011-10
 - [security] Fixed local file inclusion vulnerability and code execution, see PMASA-2011-11
diff --git a/js/functions.js b/js/functions.js
index 75fd6776d..b07666186 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -170,11 +170,11 @@ function selectContent( element, lock, only_once ) {
 
     element.select();
 }
 
 /**
- * Displays a confirmation box before to submit a "DROP/DELETE/ALTER" query.
+ * Displays a confirmation box before submitting a "DROP/DELETE/ALTER" query.
  * This function is called while clicking links
  *
  * @param   object   the link
  * @param   object   the sql query to submit
  *
@@ -1655,11 +1655,11 @@ $(document).ready(function() {
 
         //context is top.frame_content, so we need to use window.parent.db to access the db var
         /**
          * @var question    String containing the question to be asked for confirmation
          */
-        var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + window.parent.db;
+        var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + escapeHtml(window.parent.db);
 
         $(this).PMA_confirm(question, $(this).attr('href') ,function(url) {
 
             PMA_ajaxShowMessage(PMA_messages['strProcessingRequest']);
             $.get(url, {'is_js_confirmed': '1', 'ajax_request': true}, function(data) {
@@ -2285,5 +2285,16 @@ $(document).ready(function() {
             }
         });
 
 }) // end of $(document).ready()
 
+/**
+ * HTML escaping
+ */
+function escapeHtml(unsafe) {
+    return unsafe
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#039;");
+}
diff --git a/js/tbl_structure.js b/js/tbl_structure.js
index 352848cb6..493f0eb4e 100644
--- a/js/tbl_structure.js
+++ b/js/tbl_structure.js
@@ -42,11 +42,11 @@ $(document).ready(function() {
          */
         var curr_column_name = $(curr_row).children('th').children('label').text();
         /**
          * @var question    String containing the question to be asked for confirmation
          */
-        var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` DROP `' + curr_column_name + '`';
+        var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` DROP `' + escapeHtml(curr_column_name) + '`';
 
         $(this).PMA_confirm(question, $(this).attr('href'), function(url) {
 
             PMA_ajaxShowMessage(PMA_messages['strDroppingColumn']);
 
@@ -81,11 +81,11 @@ $(document).ready(function() {
          */
         var curr_column_name = $(this).parents('tr').children('th').children('label').text();
         /**
          * @var question    String containing the question to be asked for confirmation
          */
-        var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` ADD PRIMARY KEY(`' + curr_column_name + '`)';
+        var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` ADD PRIMARY KEY(`' + escapeHtml(curr_column_name) + '`)';
 
         $(this).PMA_confirm(question, $(this).attr('href'), function(url) {
 
             PMA_ajaxShowMessage(PMA_messages['strAddingPrimaryKey']);
 

Vulnerable code: - [security] Fixed XSS in Inline Edit on save action
 * Displays a confirmation box before to submit a "DROP/DELETE/ALTER" query.
        var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + window.parent.db;
        var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` DROP `' + curr_column_name + '`';
        var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` ADD PRIMARY KEY(`' + curr_column_name + '`)';
Fixed code: - [security] Fixed XSS in Inline Edit on save action, see PMASA-2011-14
- [security] Fixed XSS with db/table/column names, see PMASA-2011-14 
 * Displays a confirmation box before submitting a "DROP/DELETE/ALTER" query.
        var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + escapeHtml(window.parent.db);
/**
 * HTML escaping
 */
function escapeHtml(unsafe) {
    return unsafe
        .replace(/&/g, "&amp;")
        .replace(/</g, "&lt;")
        .replace(/>/g, "&gt;")
        .replace(/"/g, "&quot;")
        .replace(/'/g, "&#039;");
}
        var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` DROP `' + escapeHtml(curr_column_name) + '`';
        var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` ADD PRIMARY KEY(`' + escapeHtml(curr_column_name) + '`)';