Version 1.3.4: XSS vulnerability fix

Released version 1.3.4 today(up from 1.3.4b) which fixes a XSS vulnerability.



Edited 1 time(s). Last edit at 06/04/2008 10:30PM by Ando.

Can we have a changelog please, Ando?

He only modified .../include/searchfuncs.php with a small modification. And that should prevent XSS attacks???



Edited 1 time(s). Last edit at 04/29/2008 08:58PM by Tec.

Okay,

I located the changes, very minor changes indeed.

Greetings!

Tec Wrote:
-------------------------------------------------------
> He only modified .../include/searchfuncs.php with
> a small modification. And that should prevent XSS
> attacks???

Yes, the original code was using an unsanitized string which was printed to output. The change is about using the sanitized string instead. So the change indeed does prevent XSS attacks.

XSS attacks are not a problem for 'printing to output' as you wrote. I'm sure you know quite well that XSS attacks are dangerous to destroy the database. That is why I build the secure mod that really prevents dangerous query input. I think I don't need to remember you that all query input are stored in querylog. And also in the newest version of Sphider you still use:
saveToLog(addslashes($query), $time, $rows);
That is why I first "cleaned" all input before processed.

Tec

No, you are confusing SQL injection and XSS attacks.

Well, on a first impression you may limit XSS attacks to print outs. But this is only a disfigurement on the monitor. Perhaps the XSS (Cross Site Scripting) Cheat Sheet
[ha.ckers.org]
might give an impression about XSS complexity.

Never the less we should not run into a competition on how much security is necessary or required. The users may decide individually how much they intend to investigate.

Tec

People you should try something like phpids with sphider. Don' t waste your time in fixing XSS vulnerabilities with Sphider. Or maybe secure you whole site with phpids. Only my opinion.

I user sphider plus, can i replace only searchfuncs.php?
Thanks

Hello Stefano,

No, as stated in readme.pdf, Sphider-plus and original Sphider scripts are not interchangeable.

If you want to integrate Ando's v.1.3.4 news into Sphider-plus, open .../include/searchfuncs.php and search for:

$did_you_mean_b=$query;
$did_you_mean=$query;

Delete that two rows and replace them with the following:

$did_you_mean_b=$entitiesQuery;
$did_you_mean=$entitiesQuery;

In the same file search for:

$full_result['query'] = $query;

Delete that row and replace it with the following:

$full_result['query'] = $entitiesQuery;


That's all.

Tec