XSS vulnerability in search (medial_search) with q parameter

geneontology / amigo

AmiGO is the public interface for the Gene Ontology.

http://amigo.geneontology.org

BSD 3-Clause "New" or "Revised" License

29 stars 17 forks source link

XSS vulnerability in search (medial_search) with q parameter #682

Closed kltm closed 1 year ago

kltm commented 1 year ago

It is currently possible to inject disrupting code into the search (medial_search) q parameter that could be used to create an XSS attack for users on bad links. For example, the following URLs illustrate this, disrupting the variable creation:

https://amigo-staging.geneontology.io/amigo/medial_search?q=--%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3C!--

Fixing would be better serialization on variable rendering.

kltm commented 1 year ago

Noting the theme https://github.com/geneontology/amigo/issues/575

kltm commented 1 year ago

Up on staging. Pinged LBL back in email.

kltm commented 1 year ago

Report for LBL that we're good. We should propagate this to other AmiGOs.