Changeset 28888 for main/trunk/greenstone2/runtime-src

Timestamp:

2014-03-13T14:34:48+13:00 (10 years ago)

Author:

ak19

Message:

First security commit. 1. Introducing the new securitools.h and .cpp files, which port the functions necessary to implement security in Greenstone from OWASP-ESAPI for Java, since OWASP's C++ version is largely not yet implemented, even though their code compiles. The newly added runtime-src/packages/security which contains OWASP ESAPI for C++ will therefore be removed again shortly. 2. receptionist.cpp now sets various web-encoded variants for each cgiarg macro, such as HTML entity encoded, attr encoded, javascript encoded (and css encoded variants). These are now used in the macro files based on which variant is suited to the context. 3. This commit further contains the minimum changes to protect the c, d, and p cgi variables.

Location:

main/trunk/greenstone2/runtime-src

Files:

• packages/Makefile.in (modified) (3 diffs)
• src/recpt/Makefile.in (modified) (3 diffs)
• src/recpt/action.h (modified) (1 diff)
• src/recpt/basequeryaction.cpp (modified) (1 diff)
• src/recpt/cgiutils.cpp (modified) (1 diff)
• src/recpt/pageaction.cpp (modified) (3 diffs)
• src/recpt/queryaction.cpp (modified) (2 diffs)
• src/recpt/receptionist.cpp (modified) (4 diffs)
• src/recpt/securitytools.cpp (added)
• src/recpt/securitytools.h (added)
• src/recpt/sqlqueryaction.cpp (modified) (2 diffs)

main/trunk/greenstone2/runtime-src/packages/Makefile.in

@@ -29 +29 @@
 USE_YAZ=@USE_YAZ@
 USE_APACHE_HTTPD=@USE_APACHE_HTTPD@
-
-
-SECURITY=security/libgpg-error-1.12
-#security/libgcrypt-1.6.1
 
 ifeq ($(USE_Z3950), 1)
@@ -74 +70 @@
 # is assumed that each package will have at least four rules: all, install,
 # clean, and distclean.
-INSTALLDIRS =   $(YAZ) $(D2M) $(CORBA) $(SECURITY)
+INSTALLDIRS =   $(YAZ) $(D2M) $(CORBA)
 PACKAGEDIRS =   $(INSTALLDIRS) $(HTTPD)
 
@@ -133 +129 @@
     cd yaz/yaz-2.1.4/src; $(MAKE)  $(MDEFINES) install
 endif
-
-# make install all packages in the security folder
-
 
 # now install everything except apache, since that had already been installed during "all"

main/trunk/greenstone2/runtime-src/src/recpt/Makefile.in

@@ -155 +155 @@
 APACHE_MODULE =
 endif
+
 
 # Extension support
@@ -229 +230 @@
     $(RSS_SOURCES) \
     statusaction.cpp \
+    securitytools.cpp \
     summarise.cpp \
     tipaction.cpp \
@@ -278 +280 @@
     $(RSS_OBJECTS) \
     statusaction.o \
+    securitytools.o \
     summarise.o \
     tipaction.o \

main/trunk/greenstone2/runtime-src/src/recpt/action.h

@@ -34 +34 @@
 #include "recptproto.h"
 #include "browserclass.h"
+#include "securitytools.h"
 
 #if defined(GSDL_USE_OBJECTSPACE)

main/trunk/greenstone2/runtime-src/src/recpt/basequeryaction.cpp

@@ -651 +651 @@
 
     // Display the "this collection is not installed on this system" page
-    disp.setmacro("cvariable", displayclass::defaultpackage, collection);
+    disp.setmacro("cvariable", displayclass::defaultpackage, encodeForHTML(collection));
     disp.setmacro("content", "query", "<p>_textbadcollection_<p>");
 

main/trunk/greenstone2/runtime-src/src/recpt/cgiutils.cpp

@@ -44 +44 @@
 
 // set to false to undo security changes (url-encoding arguments)
-static bool do_safe_cgi_args = true;
+static bool do_safe_cgi_args = false;
 
 static unsigned short hexdigit (unsigned short c) {

main/trunk/greenstone2/runtime-src/src/recpt/pageaction.cpp

@@ -751 +751 @@
   if (arg_p == "about") {
     if (cinfo == NULL) {
-      disp.setmacro("cvariable", displayclass::defaultpackage, arg_c);
+      disp.setmacro("cvariable", displayclass::defaultpackage, encodeForHTML(arg_c));
       disp.setmacro("content", arg_p, "<p>_textbadcollection_<p>");
       return;
@@ -797 +797 @@
   
     if (cinfo == NULL) {
-      disp.setmacro("cvariable", displayclass::defaultpackage, arg_c);
+      disp.setmacro("cvariable", displayclass::defaultpackage, encodeForHTML(arg_c));
       disp.setmacro("content", arg_p, "<p>_textbadcollection_<p>");
       return;
@@ -1009 +1009 @@
   text_t &arg_p = args["p"];
 
-  textout << outconvert << disp << ("_" + arg_p + ":header_\n")
-      << ("_" + arg_p + ":content_\n")
-      << ("_" + arg_p + ":footer_\n");
+  textout << outconvert << disp << ("_" + encodeForHTML(arg_p) + ":header_\n")
+      << ("_" + encodeForHTML(arg_p) + ":content_\n")
+      << ("_" + encodeForHTML(arg_p) + ":footer_\n");
 
   return true;

main/trunk/greenstone2/runtime-src/src/recpt/queryaction.cpp

@@ -1010 +1010 @@
 
     // Display the "this collection is not installed on this system" page
-    disp.setmacro("cvariable", displayclass::defaultpackage, main_collection);
+    disp.setmacro("cvariable", displayclass::defaultpackage, encodeForHTML(main_collection));
     disp.setmacro("content", "query", "<p>_textbadcollection_<p>");
 
@@ -1394 +1394 @@
     }
 
-    disp.setmacro ("decodedcompressedoptions", displayclass::defaultpackage, dm_safe(compressedoptions));
+    text_t macrovalue = dm_safe(compressedoptions);
+    disp.setmacro ("decodedcompressedoptions", displayclass::defaultpackage, macrovalue);
+    disp.setmacro ("decodedcompressedoptionsAttrsafe", displayclass::defaultpackage, encodeForHTMLAttr(macrovalue));
+    
       }
     } // form search

main/trunk/greenstone2/runtime-src/src/recpt/receptionist.cpp

@@ -36 +36 @@
 #include "gsdltimes.h"
 #include "OIDtools.h"
+#include "securitytools.h"
 #include <assert.h>
 #include <time.h>
@@ -1485 +1486 @@
     compressedoptions = to_uni(compressedoptions);
   }
-  disp.setmacro ("decodedcompressedoptions", displayclass::defaultpackage, dm_safe(compressedoptions)); 
+
+  text_t dmacrovalue = dm_safe(compressedoptions);
+  disp.setmacro ("decodedcompressedoptions", displayclass::defaultpackage, dmacrovalue); 
+  disp.setmacro ("decodedcompressedoptionsAttrsafe", displayclass::defaultpackage, encodeForHTMLAttr(dmacrovalue));
 
 #if defined (__WIN32__)
@@ -1495 +1499 @@
   cgiargsclass::const_iterator argsend = args.end();
   while (argshere != argsend) {
+
+    text_t macrovalue = (*argshere).second.value; // and stays like that if ((*argshere).first == "hp")
+
     if (((*argshere).first == "q") ||
     ((*argshere).first == "qa") ||
@@ -1502 +1509 @@
     ((*argshere).first == "qpl") ||
     ((*argshere).first == "qr") ||
-    ((*argshere).first == "q2"))
+    ((*argshere).first == "q2")) {
+
       // need to escape special characters from query string
-      disp.setmacro ("cgiarg" + (*argshere).first, 
-             displayclass::defaultpackage, html_safe((*argshere).second.value));
-    else if ((*argshere).first == "hp") {
-      disp.setmacro ("cgiarg" + (*argshere).first, displayclass::defaultpackage, (*argshere).second.value);
-    } else {
-      disp.setmacro ("cgiarg" + (*argshere).first, displayclass::defaultpackage, dm_safe((*argshere).second.value));
-    }
+      macrovalue = html_safe(macrovalue);
+
+    } else  if ((*argshere).first == "hp") {
+      if(!isValidURLProtocol(macrovalue)) {
+    macrovalue = encodeForURL(macrovalue); // URL has invalid protocol like javascript:, so URL encode it
+      }
+    }
+    else {
+      macrovalue = dm_safe(macrovalue);
+    }   
+
+    // set the default value for the macro
+    disp.setmacro ("cgiarg" + (*argshere).first, displayclass::defaultpackage, macrovalue);
+
+    // set macros for the encoded versions of the same value. Uses the functions in securitytools.h
+    // https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet
+
+    text_t htmlsafe = encodeForHTML(macrovalue);
+    text_t attrsafe = encodeForHTMLAttr(macrovalue);
+    text_t urlsafe = encodeForURL(macrovalue);
+    text_t jssafe = encodeForJavascript(macrovalue);
+    text_t csssafe = encodeForCSS(macrovalue);
+
+    disp.setmacro ("cgiarg" + (*argshere).first + "Htmlsafe", displayclass::defaultpackage, htmlsafe);    
+    disp.setmacro ("cgiarg" + (*argshere).first + "Attrsafe", displayclass::defaultpackage, attrsafe);
+    disp.setmacro ("cgiarg" + (*argshere).first + "Jssafe", displayclass::defaultpackage, jssafe);
+    disp.setmacro ("cgiarg" + (*argshere).first + "Csssafe", displayclass::defaultpackage, csssafe);
+    disp.setmacro ("cgiarg" + (*argshere).first + "Urlsafe", displayclass::defaultpackage, urlsafe);
+    
+
     ++argshere;
   }

main/trunk/greenstone2/runtime-src/src/recpt/sqlqueryaction.cpp

@@ -309 +309 @@
       compressedoptions = to_uni(compressedoptions);
     }
-
-    disp.setmacro ("decodedcompressedoptions", displayclass::defaultpackage, dm_safe(compressedoptions));
+    
+    text_t dmacrovalue = dm_safe(compressedoptions);
+    disp.setmacro ("decodedcompressedoptions", displayclass::defaultpackage, dmacrovalue);
+    disp.setmacro ("decodedcompressedoptionsAttrsafe", displayclass::defaultpackage, encodeForHTMLAttr(dmacrovalue));
       }
     } // form search
@@ -317 +319 @@
     logout << "ERROR (sqlqueryaction::get_formatted_query_string): querytype not defined\n";
   }
-
-
-
-
 
 }