{"action":"created","issue":{"url":"https://api.github.com/repos/jcu-eresearch/matrix-helpers/issues/61","repository_url":"https://api.github.com/repos/jcu-eresearch/matrix-helpers","labels_url":"https://api.github.com/repos/jcu-eresearch/matrix-helpers/issues/61/labels{/name}","comments_url":"https://api.github.com/repos/jcu-eresearch/matrix-helpers/issues/61/comments","events_url":"https://api.github.com/repos/jcu-eresearch/matrix-helpers/issues/61/events","html_url":"https://github.com/jcu-eresearch/matrix-helpers/issues/61","id":206101722,"number":61,"title":"Global 'get' and 'post' now populate %nested_get_*% keywords","user":{"login":"davidjb","id":1002811,"avatar_url":"https://avatars3.githubusercontent.com/u/1002811?v=3","gravatar_id":"","url":"https://api.github.com/users/davidjb","html_url":"https://github.com/davidjb","followers_url":"https://api.github.com/users/davidjb/followers","following_url":"https://api.github.com/users/davidjb/following{/other_user}","gists_url":"https://api.github.com/users/davidjb/gists{/gist_id}","starred_url":"https://api.github.com/users/davidjb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidjb/subscriptions","organizations_url":"https://api.github.com/users/davidjb/orgs","repos_url":"https://api.github.com/users/davidjb/repos","events_url":"https://api.github.com/users/davidjb/events{/privacy}","received_events_url":"https://api.github.com/users/davidjb/received_events","type":"User","site_admin":false},"labels":[{"id":497421274,"url":"https://api.github.com/repos/jcu-eresearch/matrix-helpers/labels/awaiting-vendor","name":"awaiting-vendor","color":"000000","default":false},{"id":397760402,"url":"https://api.github.com/repos/jcu-eresearch/matrix-helpers/labels/bug","name":"bug","color":"ee0701","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-02-08T05:40:28Z","updated_at":"2017-07-12T23:58:04Z","closed_at":null,"body":"## Problem\r\n\r\nUse of `%nested_get_*%` keywords were previously only populated via `^with_get` keyword arguments, meaning they were separated from the main request.  However, these keywords are  now being populated with anything that is passed in the main request, such as via `?foobar=1234` in the query string.  This appears to have been a change between 5.3.3 where we noted it wasn't happening through to 5.4.0.3, where it is now.\r\n\r\nThis presents a XSS security risk if these types of keywords are outputted in any unsantised fashion onto a page.  If these values are otherwise used conditionally or passed through other keyword modifiers, that's a security and stability risk as well as potential for data leakage.\r\n\r\nThis problem may also extend to `%nested_post_*%` though we never had a need for this feature previously.\r\n\r\nFinally, whilst these keywords are only mentioned deep down on the Nest Content documentation page (https://matrix.squiz.net/manuals/content-types/chapters/nest-content), they keywords themselves resolve in any context (such as a Standard Page's bodycopy divs).  So, there's the potential for someone to be inadvertently using such a keyword elsewhere.  If it's not a regression, then some clear documentation needs to be added to this page to explain the behaviour so XSS problems can be avoided.\r\n\r\n## Versions\r\n\r\nThis issue needs to be checked further as we no longer have access to Matrix 5.3.3.  However, indications are that this changed between 5.3.3 and 5.4.0.3.\r\n"},"comment":{"url":"https://api.github.com/repos/jcu-eresearch/matrix-helpers/issues/comments/314930824","html_url":"https://github.com/jcu-eresearch/matrix-helpers/issues/61#issuecomment-314930824","issue_url":"https://api.github.com/repos/jcu-eresearch/matrix-helpers/issues/61","id":314930824,"user":{"login":"davidjb","id":1002811,"avatar_url":"https://avatars3.githubusercontent.com/u/1002811?v=3","gravatar_id":"","url":"https://api.github.com/users/davidjb","html_url":"https://github.com/davidjb","followers_url":"https://api.github.com/users/davidjb/followers","following_url":"https://api.github.com/users/davidjb/following{/other_user}","gists_url":"https://api.github.com/users/davidjb/gists{/gist_id}","starred_url":"https://api.github.com/users/davidjb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidjb/subscriptions","organizations_url":"https://api.github.com/users/davidjb/orgs","repos_url":"https://api.github.com/users/davidjb/repos","events_url":"https://api.github.com/users/davidjb/events{/privacy}","received_events_url":"https://api.github.com/users/davidjb/received_events","type":"User","site_admin":false},"created_at":"2017-07-12T23:58:04Z","updated_at":"2017-07-12T23:58:04Z","body":"Apparently nested-get/post getting populated by the global GET/POST request was *already* the case originally, but the security issue is that the nested counterparts weren't being sanitised.  Oops.\r\n\r\nVendor has stated release pending in 5.3.7.1, 5.4.2.1, 5.5.0.0.  Either way, we still need to be careful and review our code in case this change breaks what we've done."}}
{"actor":{"display_login":"davidjb"}}