[ php-blog-Bugs-1918786 ] Wrong generation of Karma voting links

Bugs item #1918786, was opened at 2008-03-18 17:25
Message generated for change (Comment added) made by slothman
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1918786&group_id=75065

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Plugins
Group: None
Status: Open
>Resolution: Fixed
Priority: 4
Private: No
Submitted By: Simone Tellini (tellini)
Assigned to: Jude Anthony (slothman)
Summary: Wrong generation of Karma voting links

Initial Comment:
After upgrading to 1.3, I've decided to try the improved karma plugin. As soon as I've enabled it, my logs started to fill with suspicious links like:

[18/Mar/2008:13:55:39 -0700] "GET /blog/index.php?&serendipity[karmaVo
te]=1&serendipity[karmaId]=50&serendipity[karmaVote]=ht
tp%3A%2F%2Fwww.destinationthesun.info%2Fcapeverde%2Fform%2Fuse%2Fsampleform%2Fadmin%2Fitixahe%2Frilika%2F&a
mp;amp;amp;amp;serendipity[karmaId]=48&serendipity[karmaVote]=-2&se
rendipity[karmaId]=50&serendipity[karmaVote]=-2&serendipity[karmaId]=51&amp
;amp;amp;amp;amp;serendipity[karmaVote]=-2&serendipity[karmaId]=52&serendipity[karmaVot
e]=2&serendipity[karmaId]=46&serendipity[karmaVote]=-2&serendipity[karmaId]=45&
amp;serendipity[karmaVote]=1&serendipity[karmaId]=52&serendipity[karmaVote]=1&serendipity[karmaId]=46 HTTP/
1.0" 200 106464 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"


Apart from the fact that the undesired URL (www.destinationthesun.info) doesn't appear to cause much damage, I think that the URL generation could be improved.

In fact, even when someone is not trying to exploit the plugin, after you vote you can find URLs like the following one in the page:

/blog/index.php?&serendipity[karmaVote]=2&serendipity[karmaId]=50&serendipity[karmaVote]=2&serendipity[karmaId]=43#karma_vote43

There seem to be a bit of confusion in the query string ;-)

----------------------------------------------------------------------

>Comment By: Jude Anthony (slothman)
Date: 2008-05-15 13:43

Message:
Logged In: YES 
user_id=228551
Originator: NO

After prolonged discussion with Garvin and other developers, I understand
that I can't filter suspicious URLs because the plugin has no way to
distinguish them from other useful URLs, such as permalinks and
plugin-specified URLs. However, we MUST sanitize them to prevent cross-site
scripting and similar attacks; luckily, this is already done in the
Serendipity core. 

If there was some way to filter the URLs, it would probably go in the core
code, under serendipity_getCurrentURL() or something similar.  However,
since plugins can create new valid URLs, and some Serendipity variables can
be set from the URL, canonicalizing URLs would be a difficulat task.  It
should probably be reported as a feature request, unless we can determine
some way that it causes undesired behavior.

Meanwhile, the Karma plugin was adding multiple copies of its variables to
the URL after voting from a summary page.  I resolved that problem by
making the Karma plugin check for and remove its own variables before
adding new ones to the voting links.

----------------------------------------------------------------------

Comment By: Jude Anthony (slothman)
Date: 2008-05-15 13:43

Message:
Logged In: YES 
user_id=228551
Originator: NO

Based on your report we were able to solve this problem.

The problem has therefore been fixed in our CVS Repository and
will appear in our next release.

Thank you for helping us making serendipity better.

----------------------------------------------------------------------

Comment By: Jude Anthony (slothman)
Date: 2008-03-20 09:09

Message:
Logged In: YES 
user_id=228551
Originator: NO

After testing on a sandbox server, I can confidently state that these XSS
attempts are merely attempts.  They can create ugly links, but Serendipity
will continue to interpret the links correctly.  Serendipity escapes all
the output, so no input can result in the execution of scripts or
redirection of links.  The karma plugin validates its input, so no voting
can take place with the mangled links.

Since there isn't a security issue, I'm dropping the priority of this bug
a bit.

However, I'm still trying to clean up the URLs.  At the very least, I'll
get the multiple karma bits removed; my goal is to obtain the minimal URL
for a given page.

Thank you for your bug report.  You can safely re-enable the karma plugin.
 To avoid the confused query strings, turn off the option allowing voting
on the front page.

Judebert



----------------------------------------------------------------------

Comment By: Jude Anthony (slothman)
Date: 2008-03-19 16:57

Message:
Logged In: YES 
user_id=228551
Originator: NO

OK, I'm seeing the problem.  You should only get the doubled-URL problem
when you've voted on a page with multiple votes.  This is because, as you
suggest, each vote is appended to serendipity_currentURL().  I need some
way to verify the query components of the URL before I append to it.

I don't know if this could result in a real XSS problem.  Everything is
passed through Serendipity's index.php, so you'll never be visiting a
different site, even if you click on a link with extra junk in it.  The
worst that I can imagine would be voting for the wrong entry.

----------------------------------------------------------------------

Comment By: Jude Anthony (slothman)
Date: 2008-03-19 08:11

Message:
Logged In: YES 
user_id=228551
Originator: NO

I'll have a look at it.  There should only bee one karmaID and one
karmaVote in a link.  I'll find out why that's happening and sanitize the
input while I'm at it.

----------------------------------------------------------------------

Comment By: Simone Tellini (tellini)
Date: 2008-03-18 19:05

Message:
Logged In: YES 
user_id=411163
Originator: YES

my blog is at http://tellini.info - but I've disabled the karma plugin at
the moment.

I haven't touched anything regarding permalinks: they're set to the
default values.

The destinationthesun.info URL is picked from the query string: it seems
like someone was trying an XSS attack of some sort with several different
URLs (that one was just an example from the log). The karma plugin simply
writes all the values it gets from the request in the URL, even though
they're plainly bogus.

As to the second problem (duplication of values in the query string after
a vote), after  a quick look at the code, I guess it's due to the fact that
the url is always created appending the parameters to
serendipity_currentURL(), not considering that after a submit the current
url already has a query string

----------------------------------------------------------------------

Comment By: Garvin Hicking (garvinhicking)
Date: 2008-03-18 17:49

Message:
Logged In: YES 
user_id=473563
Originator: NO

Hi!

Thank you for reporting this. Even though many people tested the karma
plugin, this error has not yet surfaced.

First off, what is the URL to your Blog? It looks like this URL is picked
up from somewhere, and misconfigured permalinks MIGHt be a possible
explaination. Did you change anything in your permalink configuration of
the s9y blog?

Regards,
Garvin

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=542822&aid=1918786&group_id=75065

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft 
Defy all challenges. Microsoft(R) Visual Studio 2008. 
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/