Skip to content

[CA-5816] The parameter ReachFivesocialName in the endpoint /ReachFiveController-InitLinkAccount is vulnerable to XSS #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
moust wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[CA-5816] The parameter ReachFivesocialName in the endpoint /ReachFiveController-InitLinkAccount is vulnerable to XSS #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions Metadata/site_template/meta/system-objecttype-extensions.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -216,6 +216,13 @@
<mandatory-flag>false</mandatory-flag>
<externally-managed-flag>false</externally-managed-flag>
</attribute-definition>
<attribute-definition attribute-id="reach5SupportedSocialNames">
<display-name xml:lang="x-default">Supported ReachFive Social Provider Names</display-name>
<description xml:lang="x-default">Whitelist of allowed social provider names.</description>
<type>set-of-string</type>
<mandatory-flag>true</mandatory-flag>
<externally-managed-flag>false</externally-managed-flag>
</attribute-definition>
<attribute-definition attribute-id="reach5UiSdkUrl">
<display-name xml:lang="x-default">Web UI SDK Url</display-name>
<description xml:lang="x-default">ReachFive Web UI SDK Url.</description>
Expand Down Expand Up @@ -471,6 +478,7 @@
<attribute attribute-id="reach5CoreSdkUrl"/>
<attribute attribute-id="reach5SupportedLanguageCodes"/>
<attribute attribute-id="reach5DefaulLanguageCode"/>
<attribute attribute-id="reach5SupportedSocialNames"/>
<attribute attribute-id="reachFiveCheckCredentials"/>
<attribute attribute-id="load-social-connect"/>
<attribute attribute-id="load-social-connect2"/>
Expand Down
25 changes: 25 additions & 0 deletions Metadata/site_template/sites/RefArch/preferences.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,31 @@
<value>it</value>
<value>nl</value>
</preference>
<preference preference-id="reach5SupportedSocialNames">
<value>akamai</value>
<value>amazon</value>
<value>apple</value>
<value>bconnect</value>
<value>facebook</value>
<value>franceconnect</value>
<value>google</value>
<value>kakaotalk</value>
<value>line</value>
<value>linkedin</value>
<value>mailru</value>
<value>microsoft</value>
<value>naver</value>
<value>okta</value>
<value>oney</value>
<value>paypal</value>
<value>ping</value>
<value>qq</value>
<value>tiktok</value>
<value>twitter</value>
<value>vkontakte</value>
<value>wechat</value>
<value>weibo</value>
</preference>
<preference preference-id="authenticated">sdkUiClient.showSocialAccounts({
accessToken: accessToken,
container: 'social-accounts-container'
Expand Down
4 changes: 4 additions & 0 deletions cartridges/int_reachfive/cartridge/models/reachfiveSettings.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ var LOGGER = require('dw/system/Logger').getLogger('loginReachFive');
* @property {string} reach5CoreSdkUrl - Web Core SDK Url
* @property {Array} reach5SupportedLanguageCodes - Supported ReachFive LanguageCodes
* @property {string} reach5DefaulLanguageCode - Default ReachFive LanguageCode
* @property {Array} reach5SupportedSocialNames - Supported ReachFive Social Provider Names
* @property {string} reachFiveCheckCredentials - Check credentials method
* @property {boolean} isReachFiveEmailAsLogin - Create profile with login as an email
* @property {boolean} isReachFiveReturnProviderToken - Retrieve the provider token in the SFCC session
Expand Down Expand Up @@ -103,6 +104,9 @@ function Settings() {
reach5DefaulLanguageCode: {
get: function () { return currentSite.getCustomPreferenceValue('reach5DefaulLanguageCode'); }
},
reach5SupportedSocialNames: {
get: function () { return currentSite.getCustomPreferenceValue('reach5SupportedSocialNames'); }
},
reachFiveCheckCredentials: {
get: function () {
var prefEnum = currentSite.getCustomPreferenceValue('reachFiveCheckCredentials');
Expand Down
7 changes: 5 additions & 2 deletions cartridges/int_reachfive_sfra/cartridge/controllers/ReachFiveController.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,15 +254,18 @@ server.get(
'InitLinkAccount',
csrfProtection.generateToken,
function (req, res, next) {
var reachfiveSettings = require('*/cartridge/models/reachfiveSettings');
var userName, rememberMe, ReachFivesocialName;
// Prefill login form if the user is registered
if (req.querystring.email) {
userName = req.querystring.email;
rememberMe = true;
}

if (req.querystring.ReachFivesocialName) {
ReachFivesocialName = req.querystring.ReachFivesocialName;
var inputSocialName = req.querystring.ReachFivesocialName;
var supportedSocialNames = reachfiveSettings.reach5SupportedSocialNames || [];
if (inputSocialName && supportedSocialNames.indexOf(inputSocialName) !== -1) {
ReachFivesocialName = inputSocialName;
}

var rurl = req.querystring.rurl || '1';
Expand Down
11 changes: 10 additions & 1 deletion cartridges/int_reachfive_sg/cartridge/controllers/ReachFiveController.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -350,10 +350,19 @@ function initLinkAccount() {
loginForm.setValue('rememberme', true);
}

var reachfiveSettings = require('*/cartridge/models/reachfiveSettings');
var validatedSocialName;

var inputSocialName = request.httpParameterMap.ReachFivesocialName.stringValue;
var supportedSocialNames = reachfiveSettings.reach5SupportedSocialNames || [];
if (inputSocialName && supportedSocialNames.indexOf(inputSocialName) !== -1) {
validatedSocialName = inputSocialName;
}

// Prepare view and render
app.getView({
RegistrationStatus: false,
ReachFivesocialName: request.httpParameterMap.ReachFivesocialName.stringValue,
ReachFivesocialName: validatedSocialName,
ShowStandardLoginToLinkAccount: true,
ContinueURL: URLUtils.https('ReachFiveController-HandleLinkForm')
}).render('account/login/reachfivelinkform');
Expand Down