[X] I agree to follow this project's Code of Conduct
Is there an existing issue for this?
[X] I have searched the existing issues
Version
10.0 RC3
Bug description
Incorrect handling of > and < characters in a search term.
The sanitization of > generates this &#62; which un-sanitizes as > which is incorrect. The sanitization of < generates this &#60; which un-sanitizes as < which is also incorrect.
It appears as if the associated code in src/Toolbox/Sanitizer.php which handles the sanitization of the original search term appears to convert the > to > and then further converts the & of the > to &, resulting in &#62; something that is wrongly unsanitized to > rather than >.
Relevant log output
No response
Page URL
front/knowbaseitem.php
Steps To reproduce
Open the Knowledgbase Search tab
Search for +Hello <World
search will complete, but search term will now read +Hello <World
Your GLPI setup information
Information about system installation and configuration
GLPI 10.0.0-rc3 ( => C:\inetpub\wwwroot\glpi10x)
Installation mode: TARBALL
Current language:en_GB
Server
Operating system: Windows NT EMPCRUUKWPBU012 6.3 build 9600 (Windows Server 2012 R2 Standard Edition) AMD64
PHP 7.4.15 cgi-fcgi (Core, PDO, Phar, Reflection, SPL, SimpleXML, Zend OPcache, apcu, bcmath, bz2, calendar, cgi-fcgi, ctype,
curl, date, dom, exif, fileinfo, filter, gd, gettext, hash, iconv, intl, json, ldap, libxml, mbstring, mysqli, mysqlnd, openssl,
pcre, readline, session, soap, sodium, standard, tokenizer, xml, xmlreader, xmlrpc, xmlwriter, zip, zlib)
Setup: max_execution_time="300" memory_limit="128M" post_max_size="8M" safe_mode="" session.save_handler="files"
upload_max_filesize="10M"
Software: Microsoft-IIS/8.5
Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Edg/100.0.1185.36
Server Software: MySQL Community Server - GPL
Server Version: 8.0.23
Server SQL Mode: STRICT_TRANS_TABLES,NO_ENGINE_SUBSTITUTION
Parameters: glpi@172.16.2.70/glpi10x
Host info: 172.16.2.70 via TCP/IP
PHP version (7.4.15) is supported.
Sessions configuration is OK.
Allocated memory is sufficient.
mysqli extension is installed.
Following extensions are installed: dom, fileinfo, json, simplexml.
curl extension is installed.
gd extension is installed.
intl extension is installed.
libxml extension is installed.
zlib extension is installed.
The constant SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES is present.
Database engine version (8.0.23) is supported.
The log file has been created successfully.
Write access to C:\inetpub\wwwroot\glpi10x/files/_cache has been validated.
Write access to C:\inetpub\wwwroot\glpi10x/config has been validated.
Write access to C:\inetpub\wwwroot\glpi10x/files/_cron has been validated.
Write access to C:\inetpub\wwwroot\glpi10x/files has been validated.
Write access to C:\inetpub\wwwroot\glpi10x/files/_dumps has been validated.
Write access to C:\inetpub\wwwroot\glpi10x/files/_graphs has been validated.
Write access to C:\inetpub\wwwroot\glpi10x/files/_lock has been validated.
Write access to C:\inetpub\wwwroot\glpi10x/files/_pictures has been validated.
Write access to C:\inetpub\wwwroot\glpi10x/files/_plugins has been validated.
Write access to C:\inetpub\wwwroot\glpi10x/files/_rss has been validated.
Write access to C:\inetpub\wwwroot\glpi10x/files/_sessions has been validated.
Write access to C:\inetpub\wwwroot\glpi10x/files/_tmp has been validated.
Write access to C:\inetpub\wwwroot\glpi10x/files/_uploads has been validated.
Web access to the files directory should not be allowed but this cannot be checked automatically on this instance.
Make sure access to error log file (/files/_log/php-errors.log) is forbidden; otherwise review .htaccess file and web server configuration.
exif extension is installed.
ldap extension is installed.
openssl extension is installed.
zip extension is installed.
bz2 extension is installed.
Zend OPcache extension is installed.
Following extensions are installed: ctype, iconv, mbstring, sodium.
Write access to C:\inetpub\wwwroot\glpi10x/marketplace has been validated.
Timezones seems loaded in database.
htmlawed/htmlawed version 1.2.6 in (C:\inetpub\wwwroot\glpi10x\vendor\htmlawed\htmlawed)
phpmailer/phpmailer version 6.6.0 in (C:\inetpub\wwwroot\glpi10x\vendor\phpmailer\phpmailer\src)
simplepie/simplepie version 1.5.8 in (C:\inetpub\wwwroot\glpi10x\vendor\simplepie\simplepie\library)
mpdf/mpdf in (C:\inetpub\wwwroot\glpi10x\vendor\mpdf\mpdf\src)
michelf/php-markdown in (C:\inetpub\wwwroot\glpi10x\vendor\michelf\php-markdown\Michelf)
true/punycode in (C:\inetpub\wwwroot\glpi10x\vendor\true\punycode\src)
iamcal/lib_autolink in (C:\inetpub\wwwroot\glpi10x\vendor\iamcal\lib_autolink)
sabre/dav in (C:\inetpub\wwwroot\glpi10x\vendor\sabre\dav\lib\DAV)
sabre/http in (C:\inetpub\wwwroot\glpi10x\vendor\sabre\http\lib)
sabre/uri in (C:\inetpub\wwwroot\glpi10x\vendor\sabre\uri\lib)
sabre/vobject in (C:\inetpub\wwwroot\glpi10x\vendor\sabre\vobject\lib)
laminas/laminas-i18n in (C:\inetpub\wwwroot\glpi10x\vendor\laminas\laminas-i18n\src)
laminas/laminas-servicemanager in (C:\inetpub\wwwroot\glpi10x\vendor\laminas\laminas-servicemanager\src)
monolog/monolog in (C:\inetpub\wwwroot\glpi10x\vendor\monolog\monolog\src\Monolog)
sebastian/diff in (C:\inetpub\wwwroot\glpi10x\vendor\sebastian\diff\src)
donatj/phpuseragentparser in (C:\inetpub\wwwroot\glpi10x\vendor\donatj\phpuseragentparser\src\UserAgent)
elvanto/litemoji in (C:\inetpub\wwwroot\glpi10x\vendor\elvanto\litemoji\src)
symfony/console in (C:\inetpub\wwwroot\glpi10x\vendor\symfony\console)
scssphp/scssphp in (C:\inetpub\wwwroot\glpi10x\vendor\scssphp\scssphp\src)
laminas/laminas-mail in (C:\inetpub\wwwroot\glpi10x\vendor\laminas\laminas-mail\src\Protocol)
laminas/laminas-mime in (C:\inetpub\wwwroot\glpi10x\vendor\laminas\laminas-mime\src)
rlanvin/php-rrule in (C:\inetpub\wwwroot\glpi10x\vendor\rlanvin\php-rrule\src)
blueimp/jquery-file-upload in (C:\inetpub\wwwroot\glpi10x\vendor\blueimp\jquery-file-upload\server\php)
ramsey/uuid in (C:\inetpub\wwwroot\glpi10x\vendor\ramsey\uuid\src)
psr/log in (C:\inetpub\wwwroot\glpi10x\vendor\psr\log\Psr\Log)
psr/simple-cache in (C:\inetpub\wwwroot\glpi10x\vendor\psr\simple-cache\src)
psr/cache in (C:\inetpub\wwwroot\glpi10x\vendor\psr\cache\src)
league/csv in (C:\inetpub\wwwroot\glpi10x\vendor\league\csv\src)
mexitek/phpcolors in (C:\inetpub\wwwroot\glpi10x\vendor\mexitek\phpcolors\src\Mexitek\PHPColors)
guzzlehttp/guzzle in (C:\inetpub\wwwroot\glpi10x\vendor\guzzlehttp\guzzle\src)
guzzlehttp/psr7 in (C:\inetpub\wwwroot\glpi10x\vendor\guzzlehttp\psr7\src)
glpi-project/inventory_format in (C:\inetpub\wwwroot\glpi10x\vendor\glpi-project\inventory_format\lib\php)
wapmorgan/unified-archive in (C:\inetpub\wwwroot\glpi10x\vendor\wapmorgan\unified-archive\src)
paragonie/sodium_compat in (C:\inetpub\wwwroot\glpi10x\vendor\paragonie\sodium_compat\src)
symfony/cache in (C:\inetpub\wwwroot\glpi10x\vendor\symfony\cache)
html2text/html2text in (C:\inetpub\wwwroot\glpi10x\vendor\html2text\html2text\src)
symfony/dom-crawler in (C:\inetpub\wwwroot\glpi10x\vendor\symfony\dom-crawler)
twig/twig in (C:\inetpub\wwwroot\glpi10x\vendor\twig\twig\src)
twig/string-extra in (C:\inetpub\wwwroot\glpi10x\vendor\twig\string-extra)
symfony/polyfill-ctype not found
symfony/polyfill-iconv not found
symfony/polyfill-mbstring not found
symfony/polyfill-php80 in (C:\inetpub\wwwroot\glpi10x\vendor\symfony\polyfill-php80)
Code of Conduct
Is there an existing issue for this?
Version
10.0 RC3
Bug description
Incorrect handling of
>
and<
characters in a search term.The sanitization of
>
generates this&#62;
which un-sanitizes as>
which is incorrect. The sanitization of<
generates this&#60;
which un-sanitizes as<
which is also incorrect.It appears as if the associated code in
src/Toolbox/Sanitizer.php
which handles the sanitization of the original search term appears to convert the>
to>
and then further converts the&
of the>
to&
, resulting in&#62;
something that is wrongly unsanitized to>
rather than>
.Relevant log output
No response
Page URL
front/knowbaseitem.php
Steps To reproduce
+Hello <World
+Hello <World
Your GLPI setup information
Information about system installation and configuration
Server
GLPI constants
Libraries
LDAP directories
SQL replicas
Notifications
Plugins list
Anything else?
No response