Re:pfSense: Open source network firewall distribution
by rgrove on Friday February 10, 2017 @02:20PM
(#13618051)
Why isn't `$id` HTML-escaped before being echoed in an HTML attribute context? That's a potential XSS vector. Slightly more difficult to exploit when pulled from `$_POST`, but still a problem.
Re:pfSense: Open source network firewall distribution
by gonzo on Friday February 10, 2017 @02:35PM
(#13618174)
it's an example.
Re:pfSense: Open source network firewall distribution
by rgrove on Friday February 10, 2017 @02:54PM
(#13618332)
I don't mean to be combative, but when providing an example of how you're planning to mitigate vulnerabilities, it seems unwise to use code that contains an easily avoidable XSS vuln. I love pfSense and have used it for years, but this sort of thing doesn't inspire confidence.
Re:pfSense: Open source network firewall distribution
by gonzo on Friday February 10, 2017 @03:22PM
(#13618550)
Understood. It wasn't provided in the example, because it is not a user-entered item and is rarely displayed on the screen. It is typically an index. In other cases (perhaps) because people who originally wrote it knew no better.
(There is a lot if "isnumeric()" stuff used around $id. I inherited this codebase.)
pfSenseHelpers.js (https://github.com/pfsense/pfsense/commit/f0136b178022cf3b04...) now contains code that intercepts clicks on anchor tags with the attribute "usepost" set. The target URL and the GET arguments are extracted from the event href attribute, and these are used to compose a new, temporary form with the previous arguments inserted as POST parameters.
Here is a simple example:
Before:
Most of the GUI is being converted to use these, and the result should be in pfSense software release 2.4.