Contrib.social

The autocomplete route/endpoint has XSS vulnerabilities

Open on Drupal.org →
Created on 30 October 2024, about 2 months ago

Problem/Motivation

I'm using the autocomplete (with Solr Terms) route as endpoint in a decoupled architecture. The query parameter allows HTML as input, so if I would inject some HTML in my query but end it with a word that has suggestions, it will also return the user input with HTML in the response.

Steps to reproduce

  1. Index some nodes with text that will give suggestion back e.g: insert numbers starting with 12.
  2. Enable and configure "Solr Terms" in autocomplete.
  3. Perform request with HTML, e.g: /search_api_autocomplete/<search_api_autocomplete_search>?q=test<img%20src%3D0%20onerror%3Dalert(document.cookie)>%2012
  4. The response is giving the user input HTML back.
    [
{
"value": "test<img src=0 onerror=alert(document.cookie)> 12",
"label": "\n<div class=\"search-api-autocomplete-suggestion\">\n      <span class=\"autocomplete-suggestion-user-input\">test&lt;img src=0 onerror=alert(document.cookie)&gt; 12</span>  </div>\n"
},
{
"value": "test<img src=0 onerror=alert(document.cookie)> 120",
"label": "\n<div class=\"search-api-autocomplete-suggestion\">\n      <span class=\"autocomplete-suggestion-user-input\">test&lt;img src=0 onerror=alert(document.cookie)&gt; 12</span>  </div>\n"
},
{
"value": "test<img src=0 onerror=alert(document.cookie)> 125",
"label": "\n<div class=\"search-api-autocomplete-suggestion\">\n      <span class=\"autocomplete-suggestion-user-input\">test&lt;img src=0 onerror=alert(document.cookie)&gt; 12</span><span class=\"autocomplete-suggestion-suggestion-suffix\">5</span>  </div>\n"
}
]

Proposed resolution

Filter out the HTML on the autocomplete query parameter.

🐛 Bug report
Status

Active

Version

1.0

Component

General code

Created by

🇳🇱Netherlands bojan_dev

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024