[
https://issues.apache.org/jira/browse/KNOX-3409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18103561#comment-18103561
]
ASF subversion and git services commented on KNOX-3409:
-------------------------------------------------------
Commit e51163532f705b1370540f9ce76f68008ff6bd5b in knox's branch
refs/heads/master from Larry McCay
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=e51163532 ]
KNOX-3409: Validate knoxauth theme name to Harden Branding Support (Reported by
Quinn Nguyen) (#1341)
* KNOX-3409: Validate knoxauth theme name to prevent DOM-based XSS
The knoxauth login page read the "theme" query parameter and wrote it into
a <link> tag via document.write() with no validation, allowing arbitrary
markup injection on the page that collects user credentials. The value was
also persisted to localStorage and replayed on later visits, so a single
malicious link kept executing on subsequent visits from a clean URL.
Theme names are now validated against ^[a-zA-Z0-9_-]{1,64}$ on every path
(URL parameter, localStorage, and the configured default), which rejects
quotes, angle brackets, dots and path separators. The stylesheet element is
built with DOM APIs instead of string concatenation, so a theme name can
never be parsed as markup. A stored value that fails validation, or that
does not resolve to an installed theme, is discarded rather than replayed.
Because the only URL the loader can produce is styles/themes/<name>/theme.css,
the themes actually installed on the server remain the effective allowlist and
no new configuration is required. The README and deployment guide are updated
to describe the validation, replacing two security claims that were inaccurate
as written.
Reported by Quinn Nguyen. Not present in any released version - the theming
feature (KNOX-3283) has only ever been on master.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
* KNOX-3409: Discard an unresolvable theme preference on the same visit
Addresses review feedback. The cleanup flag tracked whether the theme had
been read from localStorage rather than whether it is currently held there.
A theme supplied via ?theme= is persisted immediately, so it is equally
eligible for cleanup, but the flag stayed false and no onerror handler was
attached. A name that passed validation without resolving to an installed
theme was therefore saved and replayed once before being cleared.
The flag is renamed to themeIsPersisted and set after a successful
setItem, so it reflects the invariant the cleanup actually depends on.
Setting it inside the try means a failed write - localStorage disabled -
correctly leaves nothing to clean up. Behaviour for an admin-configured
theme is unchanged: a deployment error does not discard a user preference.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
> Validate knoxauth theme name to Harden the Branding Support
> ------------------------------------------------------------
>
> Key: KNOX-3409
> URL: https://issues.apache.org/jira/browse/KNOX-3409
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Reporter: Larry McCay
> Assignee: Larry McCay
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> The 'theme' query param is too open to user manipulation of the input.
> We need to harden the validation of the input to only accept what has been
> explictly configured and provided as a directory name for the theme.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
