Skip to content

Commit 633acdf

Browse files
rouiljrouilj
committed
bug(security): fix XSS exploit in devel and responsive templates
Replace all occurances of: tal:content="structure context/MUMBLE/plain" with tal:content="context/MUMBLE/plain" This seems to have been an old way to handle display of a field when the user did not have edit rights. It does not occur in current (later than 2009) classic tracker templates. But probably was unsed in earlier classic templates since devel, reponsive and the roundup issue tracker templates were based on classic. Add CVE placeholder to security.txt and link to fix directions added to upgrading.txt. Add note in announcement.txt and CHANGES.txt Add a details element around the table of contents in the upgrading guide. It was getting long. Updated a missed XSS issue in the roundup tracker template. Live site is already fixed. XSS bug reported by 4bug of ChaMd5 Security Team H1 Group
1 parent ef93885 commit 633acdf

File tree

11 files changed

+132
-32
lines changed

11 files changed

+132
-32
lines changed

‎CHANGES.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,8 @@ Fixed:
9898
Rouillard)
9999
- fix potential HTTP Response Splitting issue in
100100
roundup-server. Discovered by CodeQL in CI. (John Rouillard)
101+
- XSS issue in devel and responsive templates. Reported by 4bug of
102+
ChaMd5 Security Team H1 Group. (John Rouillard).
101103

102104
Features:
103105

‎doc/announcement.txt‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ make sure to read `docs/upgrading.txt
44
<https://www.roundup-tracker.org/docs/upgrading.html>`_ to
55
bring your tracker up to date.
66

7-
The 41 changes, as usual, include some new features and many
7+
The 42 changes, as usual, include some new features and many
88
bug fixes.
99

1010
Version 2.5.0 does not support Python 2. The minimum Python
@@ -28,6 +28,13 @@ then unpack and test/install from the tarball.
2828
Among the significant enhancements in version 2.5.0 compared to
2929
the 2.4.0 release are:
3030

31+
* **XSS vulnerability with devel and responsive templates fixed**
32+
33+
Just before release an XSS security issue with trackers based on
34+
the devel or responsive templates was discovered. The updating
35+
directions include instructions on fixing this issue with the
36+
html templates.
37+
3138
* **The property/field advanced search expression feature has been
3239
enhanced and documented.**
3340

‎doc/security.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ source release tarballs.
2828
CVE Announcements
2929
-----------------
3030

31+
* `CVE-2025-pending`_ - :ref:`XSS security issue with devel or
32+
responsive templates <CVE-2025-pending>`. Fixed in release 2.5.0,
33+
directions available for fixing trackers based on these templates.
34+
3135
* `CVE-2024-39124`_ - :ref:`classhelpers (_generic.help.html) are
3236
vulnerable to an XSS attack. <CVE-2024-39124>` Requires fixing
3337
tracker homes.
@@ -39,6 +43,8 @@ CVE Announcements
3943
executed. <CVE-2024-39126>` Fixed in release 2.4.0, directions
4044
available for fixing in prior versions.
4145

46+
.. _CVE-2025-pending:
47+
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-pending
4248
.. _CVE-2024-39124:
4349
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39124
4450
.. _CVE-2024-39125:

‎doc/upgrading.txt‎

Lines changed: 86 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,16 +91,101 @@ your database.
9191
lists.sourceforge.net). Version 2.3.0 is the last version to support
9292
XHTML.
9393

94-
Contents:
94+
.. raw:: html
95+
96+
<details>
97+
<summary>Contents:</summary>
9598

9699
.. contents::
97100
:local:
98101

102+
.. raw:: html
103+
104+
</details>
105+
99106
.. index:: Upgrading; 2.4.0 to 2.5.0
100107

101108
Migrating from 2.4.0 to 2.5.0
102109
=============================
103110

111+
.. _CVE-2025-pending:
112+
113+
XSS security issue with devel and responsive templates (required)
114+
-----------------------------------------------------------------
115+
116+
The devel and responsive templates prior to Roundup 2.5 used this
117+
construct::
118+
119+
tal:content="structure context/MUMBLE/plain"
120+
121+
Where ``MUMBLE`` is a property of your issues (e.g. title).
122+
123+
This construct allows a URL with a carefully crafted query parameter
124+
to execute arbitrary JavaScript.
125+
126+
You should check all your trackers. The classic template has not used
127+
this construct since at least 2009, but your tracker's templates may
128+
use the offending construct anyway.
129+
130+
This fix will apply if your tracker is based on the responsive or
131+
devel template. Check the TEMPLATE-INFO.txt file in your tracker
132+
home. The template name is the first component of the ``Name``
133+
field. For example a Name like::
134+
135+
Name: responsive-bugtracker
136+
137+
Name: devel-bugtracker
138+
139+
shows that tracker is based on the responsive or devel templates.
140+
141+
.. _cve-2025-pending-fixed:
142+
143+
To fix this, remove the ``structure`` declaration when it is used with
144+
a plain representation. So fixing the code by replacing the example
145+
above with::
146+
147+
tal:content="context/MUMBLE/plain"
148+
149+
prevents the attack.
150+
151+
To check for this issue, search for ``structure`` followed by
152+
``/plain`` in all your html templates. If you are on a Linux/Unix
153+
system you can search the html subdirectory of your tracker with the
154+
following::
155+
156+
grep 'structure.*/plain' *.html
157+
158+
which should return any lines with issues.
159+
160+
.. warning::
161+
162+
Backup the files in the ``html`` subdirectory of your tracker in case
163+
an edit goes wrong.
164+
165+
You can fix this issue using the GNU sed command::
166+
167+
sed -i.bak -e '/structure.*\/plain/s/structure.//' *.html
168+
169+
to edit the files in place and remove the structure keyword. It will
170+
create a ``.bak`` file with the original contents of the file. If you
171+
are on windows, some text editors support search and replace using a
172+
regular expression.
173+
174+
If the construct is split across lines::
175+
176+
tal:content="structure
177+
context/MUMBLE/plain"
178+
179+
the commands above will miss the construct. So you should also search
180+
the html files using ``grep /plain *.html`` and verify that all of the
181+
``context/MUMBLE/plain`` include ``tal:content`` as in the `fixed
182+
example above <#cve-2025-pending-fixed>`_. Any lines that have
183+
``context/MUMBLE/plain`` without ``tal:content=`` before it need to be
184+
manually verified/fixed.
185+
186+
The distributed devel and responsive templates do not split the
187+
construct across lines, but if you changed the files it may be split.
188+
104189
Deprecation Notices (required)
105190
------------------------------
106191

‎share/roundup/templates/devel/html/bug.item.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545
<td colspan="3" tal:condition="context/title/is_edit_ok"
4646
tal:content="structure python:context.title.field(size=40)">title</td>
4747
<td colspan="3" tal:condition="not:context/title/is_edit_ok">
48-
<span tal:content="structure context/title/plain"/>
48+
<span tal:content="context/title/plain"/>
4949
<input type="hidden" name="title" tal:attributes="value context/title">
5050
</td>
5151
</tr>

‎share/roundup/templates/devel/html/milestone.item.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
</td>
2929
<td colspan="5"
3030
tal:condition="python: not request.user.hasPermission('Edit')"
31-
tal:content="structure context/title/plain">
31+
tal:content="context/title/plain">
3232
title
3333
</td>
3434
</tr>
@@ -54,7 +54,7 @@
5454
</td>
5555
<td colspan="5"
5656
tal:condition="python: not request.user.hasPermission('Edit')"
57-
tal:content="structure context/status/plain">
57+
tal:content="context/status/plain">
5858
status
5959
</td>
6060
</tr>

‎share/roundup/templates/devel/html/task.item.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545
<td colspan="3" tal:condition="context/title/is_edit_ok"
4646
tal:content="structure python:context.title.field(size=60)">title</td>
4747
<td colspan="3" tal:condition="not:context/title/is_edit_ok">
48-
<span tal:content="structure context/title/plain"/>
48+
<span tal:content="context/title/plain"/>
4949
<input type="hidden" name="title" tal:attributes="value context/title">
5050
</td>
5151
</tr>

‎share/roundup/templates/responsive/html/bug.item.html‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -42,13 +42,13 @@
4242
<div class='container-fluid' tal:condition="not:context/is_edit_ok">
4343
<dl class='dl-horizontal'>
4444
<dt i18n:translate="">Title</dt>
45-
<dd tal:content="structure context/title/plain"></dd>
45+
<dd tal:content="context/title/plain"></dd>
4646
<dt i18n:translate="">Type</dt>
47-
<dd tal:content="structure context/type/plain"></dd>
47+
<dd tal:content="context/type/plain"></dd>
4848
<dt i18n:translate="">Components</dt>
49-
<dd tal:content="structure context/components/plain"></dd>
49+
<dd tal:content="context/components/plain"></dd>
5050
<dt i18n:translate="">Version</dt>
51-
<dd tal:content="structure context/versions/plain"></dd>
51+
<dd tal:content="context/versions/plain"></dd>
5252
</dl>
5353
</div>
5454
<div class='container-fluid' tal:condition="context/is_edit_ok">
@@ -126,23 +126,23 @@
126126
<div class='row-fluid'>
127127
<dl class='dl-horizontal span6'>
128128
<dt i18n:translate="">Status</dt>
129-
<dd tal:content="structure context/status/plain"></dd>
129+
<dd tal:content="context/status/plain"></dd>
130130
<dt i18n:translate="">Resolution</dt>
131-
<dd tal:content="structure context/resolution/plain"></dd>
131+
<dd tal:content="context/resolution/plain"></dd>
132132
<dt i18n:translate="">Dependencies</dt>
133-
<dd tal:content="structure context/dependencies/plain"></dd>
133+
<dd tal:content="context/dependencies/plain"></dd>
134134
<dt i18n:translate="">Superseder</dt>
135-
<dd tal:content="structure context/superseder/plain"></dd>
135+
<dd tal:content="context/superseder/plain"></dd>
136136
</dl>
137137
<dl class='dl-horizontal span6'>
138138
<dt i18n:translate="">Assigned to</dt>
139-
<dd tal:content="structure context/assignee/plain"></dd>
139+
<dd tal:content="context/assignee/plain"></dd>
140140
<dt i18n:translate="">Nosy list</dt>
141-
<dd tal:content="structure context/nosy/plain"></dd>
141+
<dd tal:content="context/nosy/plain"></dd>
142142
<dt i18n:translate="">Priority</dt>
143-
<dd tal:content="structure context/priority/plain"></dd>
143+
<dd tal:content="context/priority/plain"></dd>
144144
<dt i18n:translate="">Keywords</dt>
145-
<dd tal:content="structure context/keywords/plain"></dd>
145+
<dd tal:content="context/keywords/plain"></dd>
146146
</dl>
147147
</div>
148148
</div>

‎share/roundup/templates/responsive/html/milestone.item.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
</td>
2525
<td colspan="5"
2626
tal:condition="python: not request.user.hasPermission('Edit')"
27-
tal:content="structure context/title/plain">
27+
tal:content="context/title/plain">
2828
title
2929
</td>
3030
</tr>
@@ -50,7 +50,7 @@
5050
</td>
5151
<td colspan="5"
5252
tal:condition="python: not request.user.hasPermission('Edit')"
53-
tal:content="structure context/status/plain">
53+
tal:content="context/status/plain">
5454
status
5555
</td>
5656
</tr>

‎share/roundup/templates/responsive/html/task.item.html‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -43,11 +43,11 @@
4343
<div class='container-fluid' tal:condition="not:context/is_edit_ok">
4444
<dl class='dl-horizontal'>
4545
<dt i18n:translate="">Title</dt>
46-
<dd tal:content="structure context/title/plain"></dd>
46+
<dd tal:content="context/title/plain"></dd>
4747
<dt i18n:translate="">Type</dt>
48-
<dd tal:content="structure context/type/plain"></dd>
48+
<dd tal:content="context/type/plain"></dd>
4949
<dt i18n:translate="">Components</dt>
50-
<dd tal:content="structure context/components/plain"></dd>
50+
<dd tal:content="context/components/plain"></dd>
5151
</dl>
5252
</div>
5353
<div class='container-fluid' tal:condition="context/is_edit_ok">
@@ -61,7 +61,7 @@
6161
<div class='control-group vspace-two' tal:condition="not:context/title/is_edit_ok">
6262
<label class='control-label' i18n:translate="">Title</label>
6363
<div class='controls'>
64-
<span class='input-xxlarge uneditable-input' tal:content="structure context/title/plain"></span>
64+
<span class='input-xxlarge uneditable-input' tal:content="context/title/plain"></span>
6565
</div>
6666
</div>
6767

@@ -102,21 +102,21 @@
102102
<div class='row-fluid'>
103103
<dl class='dl-horizontal span6'>
104104
<dt i18n:translate="">Status</dt>
105-
<dd tal:content="structure context/status/plain"></dd>
105+
<dd tal:content="context/status/plain"></dd>
106106
<dt i18n:translate="">Resolution</dt>
107-
<dd tal:content="structure context/resolution/plain"></dd>
107+
<dd tal:content="context/resolution/plain"></dd>
108108
<dt i18n:translate="">Dependencies</dt>
109-
<dd tal:content="structure context/dependencies/plain"></dd>
109+
<dd tal:content="context/dependencies/plain"></dd>
110110
<dt i18n:translate="">Superseder</dt>
111-
<dd tal:content="structure context/superseder/plain"></dd>
111+
<dd tal:content="context/superseder/plain"></dd>
112112
</dl>
113113
<dl class='dl-horizontal span6'>
114114
<dt i18n:translate="">Assigned to</dt>
115-
<dd tal:content="structure context/assignee/plain"></dd>
115+
<dd tal:content="context/assignee/plain"></dd>
116116
<dt i18n:translate="">Nosy list</dt>
117-
<dd tal:content="structure context/nosy/plain"></dd>
117+
<dd tal:content="context/nosy/plain"></dd>
118118
<dt i18n:translate="">Priority</dt>
119-
<dd tal:content="structure context/priority/plain"></dd>
119+
<dd tal:content="context/priority/plain"></dd>
120120
</dl>
121121
</div>
122122
</div>

0 commit comments

Comments
 (0)