From ebd90d199df70149bf2c4098fad7138289871122 Mon Sep 17 00:00:00 2001 From: levente Date: Wed, 4 Sep 2024 10:36:22 +0300 Subject: [PATCH 1/4] SITES-24380 - Checkmarx Vulnerability - OOTB Search.js * protecting href in search component search.js against XSS --- .../search/v1/search/clientlibs/site/js/search.js | 8 +++++++- .../search/v2/search/clientlibs/site/js/search.js | 8 +++++++- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js b/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js index e7a17f1928..5ba701a008 100644 --- a/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js +++ b/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js @@ -281,11 +281,17 @@ var el = document.createElement("span"); el.innerHTML = self._elements.itemTemplate.innerHTML; el.querySelectorAll(selectors.item.title)[0].appendChild(document.createTextNode(item.title)); - el.querySelectorAll(selectors.item.self)[0].setAttribute("href", item.url); + el.querySelectorAll(selectors.item.self)[0].setAttribute("href", self._safeHref(item.url)); results.innerHTML += el.innerHTML; }); }; + Search.prototype._safeHref = function(href) { + var a = document.createElement("a"); + a.href = href; + return a.pathname; + } + Search.prototype._markResults = function() { var nodeList = this._elements.results.querySelectorAll(selectors.item.self); var escapedTerm = this._elements.input.value.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&"); diff --git a/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js b/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js index eaba51e402..0a20098911 100644 --- a/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js +++ b/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js @@ -293,11 +293,17 @@ var el = document.createElement("span"); el.innerHTML = self._elements.itemTemplate.innerHTML; el.querySelectorAll(selectors.item.title)[0].appendChild(document.createTextNode(item.title)); - el.querySelectorAll(selectors.item.self)[0].setAttribute("href", item.url); + el.querySelectorAll(selectors.item.self)[0].setAttribute("href", self._safeHref(item.url)); results.innerHTML += el.innerHTML; }); }; + Search.prototype._safeHref = function(href) { + var a = document.createElement("a"); + a.href = href; + return a.pathname; + } + Search.prototype._markResults = function() { var nodeList = this._elements.results.querySelectorAll(selectors.item.self); var escapedTerm = this._elements.input.value.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&"); From 5c90fb77c8123e93d50c42ea9aaf20050b308eb4 Mon Sep 17 00:00:00 2001 From: levente Date: Wed, 4 Sep 2024 10:55:37 +0300 Subject: [PATCH 2/4] SITES-24380 - Checkmarx Vulnerability - OOTB Search.js * protecting href in search component search.js against XSS --- .../components/search/v1/search/clientlibs/site/js/search.js | 2 +- .../components/search/v2/search/clientlibs/site/js/search.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js b/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js index 5ba701a008..be2de58550 100644 --- a/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js +++ b/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js @@ -290,7 +290,7 @@ var a = document.createElement("a"); a.href = href; return a.pathname; - } + }; Search.prototype._markResults = function() { var nodeList = this._elements.results.querySelectorAll(selectors.item.self); diff --git a/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js b/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js index 0a20098911..8d4fa6e4bd 100644 --- a/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js +++ b/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js @@ -302,7 +302,7 @@ var a = document.createElement("a"); a.href = href; return a.pathname; - } + }; Search.prototype._markResults = function() { var nodeList = this._elements.results.querySelectorAll(selectors.item.self); From a539c0127c55bb9f24b215c157e85d90d2dbb84b Mon Sep 17 00:00:00 2001 From: levente Date: Thu, 5 Sep 2024 11:15:55 +0300 Subject: [PATCH 3/4] SITES-24380 - Checkmarx Vulnerability - OOTB Search.js * protecting href in search component search.js against XSS --- .../components/search/v1/search/clientlibs/site/js/search.js | 2 +- .../components/search/v2/search/clientlibs/site/js/search.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js b/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js index be2de58550..5f8467e01c 100644 --- a/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js +++ b/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js @@ -289,7 +289,7 @@ Search.prototype._safeHref = function(href) { var a = document.createElement("a"); a.href = href; - return a.pathname; + return encodeURI(a.pathname); }; Search.prototype._markResults = function() { diff --git a/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js b/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js index 8d4fa6e4bd..b784377f6f 100644 --- a/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js +++ b/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js @@ -301,7 +301,7 @@ Search.prototype._safeHref = function(href) { var a = document.createElement("a"); a.href = href; - return a.pathname; + return encodeURI(a.pathname); }; Search.prototype._markResults = function() { From 38eeb948ac6659d173e7ae2a751a98157b82d3a3 Mon Sep 17 00:00:00 2001 From: levente Date: Mon, 9 Sep 2024 15:24:41 +0300 Subject: [PATCH 4/4] SITES-24380 - Checkmarx Vulnerability - OOTB Search.js * removed url encoding to avoid double encoding --- .../components/search/v1/search/clientlibs/site/js/search.js | 2 +- .../components/search/v2/search/clientlibs/site/js/search.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js b/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js index 5f8467e01c..be2de58550 100644 --- a/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js +++ b/content/src/content/jcr_root/apps/core/wcm/components/search/v1/search/clientlibs/site/js/search.js @@ -289,7 +289,7 @@ Search.prototype._safeHref = function(href) { var a = document.createElement("a"); a.href = href; - return encodeURI(a.pathname); + return a.pathname; }; Search.prototype._markResults = function() { diff --git a/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js b/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js index b784377f6f..8d4fa6e4bd 100644 --- a/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js +++ b/content/src/content/jcr_root/apps/core/wcm/components/search/v2/search/clientlibs/site/js/search.js @@ -301,7 +301,7 @@ Search.prototype._safeHref = function(href) { var a = document.createElement("a"); a.href = href; - return encodeURI(a.pathname); + return a.pathname; }; Search.prototype._markResults = function() {