[Koha] HTML not being encoded for display?

[Joe Atzberger]

George, Rick and all --

In short, no, MARC record subfields should not be HTML encoded.  MARC is not
a subset of HTML, and you can't just substitute &entities or suppress <tags>
and expect everything to be OK.  If you are worried about a library's
professional catalogers dropping javascript exploits into MARC fields, you
have much worse problems than any ILS can solve for you.  Don't give staff
access, let alone catalog access to such people.  One the plus side,
congratulations, you have catalogers that can code!

For user submitted data, yes, Koha should attend to sanitizing it.  But
that's not the question here.

--joe atzberger


On Wed, Mar 5, 2008 at 7:39 PM, Rick Welykochy <rick at praxis.com.au> wrote:

> George Adams wrote:
>
> > For example, in the "Add a MARC Record" section, I can enter in a title
> (tag 245c) of the following:
> >
> >    My Book is <font size="+5">Great</font>
> >
> > Sure enough, when the completed MARC record is submitted, the additem.plpage will show the title with the word "Great" really big.  Once added to
> the catalog, it will show up in the search engines with that word really big
> as well.
> >
> > Surely everything entered by users and librarian in the OPAC and
> Intranet sites should be HTML-encoded if it's going to be redisplayed,
> right?  Did I miss some setting in the Administration menus that would
> disallow HTML from being entered in a form, or is this a fairly big bug?
>
>
> This is why Koha is susceptible to cross-site scripting attacks, as
> already
> raised by someone else on this list a few months back.
>
> Example:
>
> My book is <script>alert("Gotcha!")</script>
>
> cheers
> rickw
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.katipo.co.nz/pipermail/koha/attachments/20080305/eb1f2865/attachment.htm