Skip to content
This repository was archived by the owner on Jul 3, 2018. It is now read-only.

Collection and filenames not sanitized when retrieved from iRODS server? #4

Description

@JacobOlitsky

I ran into an issue with RodsWiki (depends on PRODS) where getting the children of a collection containing a collection with invalid UTF-8 in its name results in an unhandled exception.

It seems that someone somehow got a 0byte collection with invalid characters in its name into our iRODS collection. The relevant part of the call stack provided by XDebug is

Warning: SimpleXMLElement::__construct(): Entity: line 9: parser error : Input is not proper UTF-8, indicate encoding ! Bytes: 0x92 0x39 0x01 0x3C in C:\xampp\htdocs\mediawiki\extensions\RodsWiki\irods\RODSMessage.class.php on line 140
# function location
08. ProdsDir->getChildDirs( ???, ???, ???, ??? ) ..\SpecialIrodsCollectionBrowser.php:43
09. ProdsDir->findDirs( array(2), long, long, long, array(0) ) ..\ProdsDir.class.php:182
10. RODSConn->query( object(RODSGenQueSelFlds)[110], object(RODSGenQueConds)[108], long, long ) ..\ProdsDir.class.php:708
11. RODSMessage->unpack( resource(144, stream), ??? ) ..\RODSConn.class.php:1579
12. RODSMessage->parseBodyXML( string(4770) ) ..\RODSMessage.class.php:97
13. __construct ( string(4770) ) ..\RODSMessage.class.php:140

"string(4770)" refers to a string of length 4770. I have confirmed that It contains invalid UTF-8 characters.

While the invalid character issue is merely an annoyance, I'm concerned that this represents a possible vector for XSS attacks. I'm not sure where the burden of sanitization should go, but sanitizing it in irods-php when data is retrieved from an iRODS server seems like good practice to me. I'm not yet familiar enough with irods-php to implement that myself, though.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions