Page MenuHomePhabricator
Create Task
Maniphest T86711

Fix SVG blacklist for animate
Closed, ResolvedPublic
Actions

Description

As @Bawolff pointed out in https://commons.wikimedia.org/w/index.php?title=Commons:Upload_help&diff=prev&oldid=140107883, the check I had for animating an element's href to a javascript url wasn't effective.

Fix it to blacklist animating attributeName='xlink:href'.

Patch:

t86711b.patch2 KBDownload

  • 1.24:
    t86711b.patch2 KBDownload
    (--3way)
  • 1.23:
    t86711b.patch2 KBDownload
    (--3way)
  • 1.19:
    T86711-REL1_19.patch1 KBDownload

Affected Versions: incomplete fix in patch for T71008 (1.19.19, 1.22.11 and 1.23.4)
Type: xss
CVE: CVE-2015-2932

Details

SubjectRepoBranchLines +/-
SECURITY: Fix animate blacklistmediawiki/coremaster+15 -4
SECURITY: Fix animate blacklistmediawiki/coreREL1_19+3 -4
SECURITY: Fix animate blacklistmediawiki/coreREL1_23+15 -4
SECURITY: Fix animate blacklistmediawiki/coreREL1_24+15 -4
Customize query in gerrit

Related Objects
Search...

Event Timeline

• csteipp created this task.Jan 13 2015, 10:14 PM
• csteipp raised the priority of this task from to Needs Triage.
• csteipp updated the task description. (Show Details)
• csteipp set Security to Software security bug.
• csteipp added subscribers: • csteipp, Bawolff.
Restricted Application changed the visibility from "Public (No Login Required)" to "Custom Policy". · View Herald TranscriptJan 13 2015, 10:14 PM
Restricted Application changed the edit policy from "All Users" to "Custom Policy". · View Herald Transcript
Restricted Application added a project: acl*security. · View Herald Transcript
• csteipp added a comment.Jan 14 2015, 12:50 AM

t86711.patch2 KBDownload

Restricted Application changed the visibility from "Custom Policy" to "Custom Policy". · View Herald TranscriptJan 14 2015, 12:50 AM
Restricted Application changed the edit policy from "Custom Policy" to "Custom Policy". · View Herald Transcript
Anomie subscribed.EditedJan 14 2015, 4:03 PM

The patch works as advertised, but it doesn't go far enough. The specific namespace prefix used doesn't matter, at least not in the browsers I have available (Firefox 34.0 and Chromium 39.0.2171.71).

<svg xmlns="http://www.w3.org/2000/svg" xmlns:y="http://www.w3.org/1999/xlink">
  <a y:href="#">
    <text y="1em">Click me</text>
    <animate attributeName="y:href" values="javascript:alert('Bang!')" begin="0s" dur="0.1s" fill="freeze" />
  </a>
</svg>

Also, BTW, the SVG used in the new unit test doesn't actually work for me in Firefox (it needs an existing href property on the <a>). Not that that makes a difference as far as the unit testing goes.

• csteipp added a comment.Jan 14 2015, 10:50 PM

Nice catch @Anomie!

Updated patch here:

t86711b.patch2 KBDownload

• csteipp claimed this task.Jan 15 2015, 1:05 AM
• csteipp triaged this task as Medium priority.
• csteipp added a project: MediaWiki-Core-Team.
• csteipp moved this task from Backlog to Needs Review/Feedback on the MediaWiki-Core-Team board.
Anomie added a comment.EditedJan 15 2015, 1:52 AM
In T86711#977587, @csteipp wrote:

Updated patch here:

t86711b.patch2 KBDownload

Code review: +1, Looks good, seems to work

• csteipp moved this task from Needs Review/Feedback to Done on the MediaWiki-Core-Team board.Jan 20 2015, 10:09 PM
• csteipp added a parent task: T87275: MediaWiki Security release 1.24.2.Jan 20 2015, 11:08 PM
• csteipp closed this task as Resolved.Jan 20 2015, 11:11 PM

This will be released with 1.24.2. All other work is done.

bd808 moved this task from Done to Archive on the MediaWiki-Core-Team board.Feb 5 2015, 1:58 AM
• csteipp updated the task description. (Show Details)Mar 18 2015, 1:12 AM
• csteipp added a project: Vuln-XSS.
• csteipp added a comment.Mar 24 2015, 10:51 PM

T86711-REL1_19.patch1 KBDownload
- remove unit tests for UploadBase

• csteipp updated the task description. (Show Details)Mar 24 2015, 11:02 PM
• csteipp added subscribers: Grunny, ProgramCeltic.Mar 30 2015, 8:03 PM
• csteipp changed the visibility from "Custom Policy" to "Custom Policy".Mar 31 2015, 12:39 PM
• csteipp changed the visibility from "Custom Policy" to "Public (No Login Required)".Mar 31 2015, 9:16 PM
• csteipp changed the edit policy from "Custom Policy" to "All Users".
• csteipp changed Security from Software security bug to None.
gerritbot subscribed.Mar 31 2015, 9:22 PM

Change 201013 had a related patch set uploaded (by CSteipp):
SECURITY: Fix animate blacklist

https://gerrit.wikimedia.org/r/201013

gerritbot added a project: Patch-For-Review.Mar 31 2015, 9:22 PM
gerritbot added a comment.Mar 31 2015, 9:30 PM

Change 201025 had a related patch set uploaded (by CSteipp):
SECURITY: Fix animate blacklist

https://gerrit.wikimedia.org/r/201025

gerritbot added a comment.Mar 31 2015, 9:35 PM

Change 201035 had a related patch set uploaded (by CSteipp):
SECURITY: Fix animate blacklist

https://gerrit.wikimedia.org/r/201035

gerritbot added a comment.Mar 31 2015, 9:46 PM

Change 201013 merged by jenkins-bot:
SECURITY: Fix animate blacklist

https://gerrit.wikimedia.org/r/201013

• csteipp mentioned this in rMW2759460fcedd: SECURITY: Fix animate blacklist.Mar 31 2015, 9:46 PM
gerritbot added a comment.Mar 31 2015, 10:21 PM

Change 201025 merged by jenkins-bot:
SECURITY: Fix animate blacklist

https://gerrit.wikimedia.org/r/201025

• csteipp mentioned this in rMWb30f31ac281a: SECURITY: Fix animate blacklist.Mar 31 2015, 10:22 PM
gerritbot added a comment.Mar 31 2015, 10:22 PM

Change 201035 merged by jenkins-bot:
SECURITY: Fix animate blacklist

https://gerrit.wikimedia.org/r/201035

• csteipp mentioned this in rMW116dd3a87f0b: SECURITY: Fix animate blacklist.Mar 31 2015, 10:22 PM
gerritbot added a comment.Apr 1 2015, 4:57 PM

Change 201219 had a related patch set uploaded (by CSteipp):
SECURITY: Fix animate blacklist

https://gerrit.wikimedia.org/r/201219

gerritbot added a comment.Apr 1 2015, 5:18 PM

Change 201219 merged by jenkins-bot:
SECURITY: Fix animate blacklist

https://gerrit.wikimedia.org/r/201219

• csteipp mentioned this in rMWb5f491fb6d5d: SECURITY: Fix animate blacklist.Apr 1 2015, 5:18 PM
• csteipp updated the task description. (Show Details)Apr 8 2015, 1:58 AM

Use CVE-2015-2932 for this issue involving an incomplete list of

dangerous parts of HTML5. (The list is supposed to include all uses of
'animate attributename="xlink:href"' in SVG documents.)

• chasemp added a project: Security.Feb 10 2020, 10:59 PM
• chasemp removed a project: acl*security.Feb 20 2020, 8:18 PM
Aklapper removed a subscriber: Anomie.Oct 16 2020, 5:42 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits