Closed kltm closed 3 years ago
It is currently possible to inject disrupting code into the search filters that could be used to create an XSS attack for users on bad links. For example, the following URLs illustrate this, disrupting the variable creation:
https://amigo-staging.geneontology.io/amigo/search/annotation?q=*:*&fq='%22%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Enetsparker(0x007768)%3C/scRipt%3E&sfq=document_category:%22annotation%22 https://amigostaging.geneontology.io/amigo/search/bioentity?q=*:*&fq='%22%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Enetsparker(0x005086)%3C/scRipt%3E&sfq=document_category:%22bioentity%22 https://amigo-staging.geneontology.io/gannet?mirror=amigo_2_local_default&query=%3c%2ftextarea%3e%3cscRipt%3enetsparker(0x0067DA)%3c%2fscRipt%3e
Fixing would be better serialization on variable rendering.
More examples:
http://noctua-amigo.berkeleybop.org/amigo/search/annotation?q=*:*&fq=regulates_closure%3a%22GO%3a1905213%22j0dhp%3c%2fscript%3e%3cscript%3ealert('should-not-be-seen')%3c%2fscript%3eqgeih&sfq=document_category:%22annotation%22
http://noctua-amigo.berkeleybop.org/amigo/search/bioentity?q=*:*&fq=regulates_closure%3a%22GO%3a1905212%22v6ft7%3c%2fscript%3e%3cscript%3ealert('should-not-be-seen')%3c%2fscript%3esbdnb&sfq=document_category:%22bioentity%22
http://amigo-staging.geneontology.io/amigo/search/bioentity?q=*:*&fq=regulates_closure%3a%22GO%3a1905212%22v6ft7%3c%2fscript%3e%3cscript%3ealert('should-not-be-seen')%3c%2fscript%3esbdnb&sfq=document_category:%22bioentity%22
New problematic examples:
It is currently possible to inject disrupting code into the search filters that could be used to create an XSS attack for users on bad links. For example, the following URLs illustrate this, disrupting the variable creation:
https://amigo-staging.geneontology.io/amigo/search/annotation?q=*:*&fq='%22%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Enetsparker(0x007768)%3C/scRipt%3E&sfq=document_category:%22annotation%22 https://amigostaging.geneontology.io/amigo/search/bioentity?q=*:*&fq='%22%3E%3C/style%3E%3C/scRipt%3E%3CscRipt%3Enetsparker(0x005086)%3C/scRipt%3E&sfq=document_category:%22bioentity%22 https://amigo-staging.geneontology.io/gannet?mirror=amigo_2_local_default&query=%3c%2ftextarea%3e%3cscRipt%3enetsparker(0x0067DA)%3c%2fscRipt%3e
Fixing would be better serialization on variable rendering.