geoserver/geoserver — pull request #466 by thijsbrentjens (2014-01-22 07:32:35+00:00)
Title: XSS security vulnerability fixes (for 2.1.4)

----- copied from email (http://sourceforge.net/mailarchive/message.php?msg_id=30586215) ------

Background. The problems with XSS vulnerabilities arise here:
1. In ServiceExceptions for OGC-style services (wms, wfs etc) the
vulnerability for XSS exists, because of reporting back the input in the
exceptiontext and the locator-part of the exceptions un-encoded.
2. In the WMS OpenLayers outputformat XSS vulnerability is caused by
writing the request parameters directly (unescaped) in the JavaScript
output as specified in the Openlayers template.
http://jira.codehaus.org/browse/GEOS-5318
3. through GWC WMTS and WMS interface. Exceptions are reported a bit
differently here. Bug report: http://jira.codehaus.org/browse/GEOS-4210,
but found some other XSS vulnerability.
4. in the web-admin. For the projects where I work on, the XSS
vulnerability in the web-admin is less relevant, since the webadmin is
not accessible publicly.

I have fixes available for 1 to 3. I haven't got time for 4., but hope
my examples might help others if needed. The OWASP encoder
(https://www.owasp.org/index.php/OWASP_Java_Encoder_Project) library
seemed very useful to me. It provides encoders for several context as
they call it. E.g. for XML output, HTML or JavaScript. To me it looked
the easiest and most reliable for encoding. The OWASP website also
provides lots of information on XSS and other vulnerabilities.

What I did:
1. in the platform, ows and wms packages: add the OWASP encoder library
for encoding easily for different context (e.g. encode for HTML, XML or
JavaScript)
2. changed ServiceException.java: make sure that the exception text and
locator are encoded for output in XML (as text and attribute).
3. in the OpenLayersMapOutputFormat class: encode the input parameters
for JavaScript output.
4. in util.OwsUtils added encoding for error messages, for all messages,
to make sure they are encoded properly (this makes sure that XSS does
not work with something like:
http://localhost:8080/geoserver/gwc/service/wmts?request=%22%22/%3E%3Caxmlns:a=%27http://www.w3.org/1999/xhtml%27%3E%3Ca:body%20onload=%22alert%28%27xss%27%29%22/%3E%3C/a%3E
)

Hopefully the code is clear. I used a less elegant solution first for
the ServiceException class (that is in an earlier commit), please be
aware of that when looking at the differences compared to the original
2.1.x source.

Probably, it could be done better or improved somewhere. I have done
several tests (for XSS), but would really like more (functional) tests
for the OpenLayers preview. For my cases it works fine though. Am very
curious if it's okay for you and usable for others as well.