It might sound silly but if there are no security requirements then there are no security holes.
We all know when we see something which shouldn't happen but I don't think there is any page
defining exactly what the security requirements are.
1. Users should not be able to spawn additional processes on the server.
2. Users should not be able to commit changes to the database except through the saveDocument function.
3. Users should not be able to save documents without their name as the author or contentAuthor as applicable.
4. Guests should not be able to execute server side script except that which was written and saved by a user.
This list is doesn't cover much yet, I hope to see some additions and discussion of may code may violate some
the rules as well as how we can have 'untrusted' code which is unable to violate the rules.
I propose we put up a design page for maintenance of this list.
WDYT?
Caleb
Hi,
If you are following the xwiki comments, you might have seen that I've
been working on an SVN application for XWiki.
I've published this application here:
http://code.xwiki.org/xwiki/bin/view/Applications/SVNApplication
The objective of this application is to bring to XWiki Applications more
professional development practices.
One of them is the ability to do version management of XWiki
applications. Of course XWiki contains versioning but this versioning
does not apply accross wikis and makes it difficult to contribute code
back to the community.
With the SVN application you can now directly contribute code and code
updates to the XWiki SVN contrib repository or to any other SVN
repository. You can even commit in multiple SVN repositories in the same
Wiki.
The SVN Application supports:
1/ Compare the Wiki (limited to a list of spaces) with the SVN
repository listing
- added pages in the wiki
- modified pages in the wiki
- new pages in SVN
- modified pages in SVN
- conflicting pages modified in both SVN and the Wiki
2/ Commit in the SVN Repository
3/ Update from the SVN Repostory
4/ Show differences between SVN and the Wiki (in XML)
The SVN Application does not provide merging and conflict resolution.
The SVN Application normalizes XWiki XML allowing the cleanup the XML to
not have the user, the dates, comments. This is necessary to provide
concurrent development on multiple XWiki server without telling you that
the pages have changed all the time.
The source code is of course in SVN at
http://svn.xwiki.org/svnroot/xwiki/contrib/sandbox/xwiki-svn/
Ludovic
--
Ludovic Dubost
Blog: http://blog.ludovic.org/
XWiki: http://www.xwiki.com
Skype: ldubost GTalk: ldubost
In the 2.3 timeframe, a serious security bug was fixed. Hibernate treats backslashes differently from some
database management systems and as a result native SQL can be injected through the searchDocuments function.
This means members of a wiki can finish an SQL query, also this means that badly written searchDocuments or
search queries go from small security issues to larger ones.
NOTE: Passwords are hashed (encrypted) so they cannot easily be read from the database.
Who's at risk?
Database systems which treat backslash as an escape character and allow stacked queries are susceptible to
arbitrary SELECT, INSERT, UPDATE, DELETE, and DROP statements.
These include:
MS-SQL
Postgres
Database systems which treat backslash as an escape character but disallow stacked queries are susceptible
only to arbitrary SELECT statements.
These include:
MySql
Oracle
Database systems which do not treat backslash as an escape character are not vulnerable these include:
HSQLDB (default XWiki zip/exe installation)
You can get a small groovy snippet to test your database and see if it supports stacked queries here:
http://dev.xwiki.org/xwiki/bin/view/Drafts/SecuringXWiki#HMitigationMethods…
What can be done:
#1: XWiki-2.3 and XWiki-2.2.6 Are patched to convert \ to \\ in search queries so upgrading to them will
negate the threat. You can download them here: http://www.xwiki.org/xwiki/bin/Main/Download
#2: If you compile your own branch of XWiki and are unable to upgrade, you can integrate the patch which
was used to fix the problem The patch is here:
http://dev.xwiki.org/xwiki/bin/download/Drafts/SecuringXWiki/XWIKI%2D4755%2…
Since the database controller has changed, you will likely have to port this patch to your version, what's
important is that api.XWiki.searchDocuments and api.XWiki.search have their input filtered.
#3: You can and should make sure to log unexpected SQL at the database level. XWiki doesn't usually use
the backslash character and queries containing backslashes should be logged specially. Also it is a good
idea to log (or block if possible) any SQL comment syntax. Hibernate does not support comments and comment
syntax is central to almost all SQL injection.
Caleb
The XWiki development team is pleased to announce the release of XWiki
Enterprise and XWiki Enterprise Manager 2.2.6.
Go grab it at http://www.xwiki.org/xwiki/bin/view/Main/Download
This is a bug fix release for the 2.2 branches.
Fixes since 2.2.5:
* [XWIKI-4378] - Should never deny resources access through skin URL
* [XWIKI-5004] - Inactive user should be able to access the same UI than
XWikiGuest
* [XWIKI-5005] - Form displayed to inactive user after login for account
activation does not submit to correct URL
* [XWIKI-5064] - Issue escaping " [ " when located in front of an URL
* [XWIKI-5113] - Id block inside header is badly rendered
* [XWIKI-5114] - Allow controlling the depth of headers to look for when
generating titles from document's content (configuration in xwiki.cfg)
* [XWIKI-5126] - Link to force editing a locked user is wrong in new UI
* [XWIKI-5127] - #googlecalcustom macro mixup front and background colors,
and also use a "Test" title
* [XWIKI-5128] - XWiki doesn't check groups permissions correctly in
multiwiki environment
* [XWIKI-5131] - PropUpdateAction use wrong XWiki#flushCache method
* [XAADMINISTRATION-134] - Users->add new user not using XWiki.Registration
with field validation.
* [XAADMINISTRATION-131] - Hide color theme setting from space
administration (currently unsupported at the level)
For more information see the Releases notes at:
http://www.xwiki.org/xwiki/bin/view/Main/ReleaseNotesXWikiEnterprise226
and http://www.xwiki.org/xwiki/bin/view/Main/ReleaseNotesXEM226
Thanks
-The XWiki dev team
Hi,
I am currently trying to implement a custom authentication as suggested
here:
http://platform.xwiki.org/xwiki/bin/view/AdminGuide/Authentication#HCustomA…
The custom authentication implementation works fine, its Single Sign-On
(user name is set in each request header) and I would additionally like to
fallback to login form in case no header value is set.
This works fine, but what I would like to change as well is to have the
entered credentials in the form to be checked to a specific custom table in
the database. Idea is to take the username and password and see if they
match the ones stored in the database.
I would appreciate if somebody could help with suggestions on this.
Thank you
--
View this message in context: http://xwiki.475771.n2.nabble.com/Authentification-tp4973445p4973445.html
Sent from the XWiki- Dev mailing list archive at Nabble.com.
As many already know, a serious security issue was fixed in the 2.3 timeframe. It does not affect all installations
specifically installations with databases such as MySql which disallow multiple queries to be executed at once.
Still for those who are affected this is quite serious and I believe in taking a proactive stance on security.
I would like to send a security advisory email to the users list which says the following:
1. Explain the problem clearly but without any sample exploit.
2. Provide a groovy snippet to test if a database allows multiple queries.
3. Provide a link to the patch which was used to plug the hole in 2.3 so security concerned users who are unable
to upgrade may include it in custom builds. This patch is simplistic and likely to apply cleanly or with little
work on all versions.
WDYT?
Caleb
Hi Marius,
"I've seen this exception before but I don't remember how to avoid it.
What version of the WYSIWYG editor do you use? Is your Wysiwyg.html file
similar to this
http://svn.xwiki.org/svnroot/xwiki/platform/web/tags/xwiki-web-2.1.1/wysiwy…
?"
It is similar, here is what I got:
<?xml version="1.0" encoding="ISO-8859-1" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<title>XWiki WYSIWYG Editor - Hosted Mode Demo</title>
<meta name="gwt:property" content="locale=en" />
<script type="text/javascript"
src="/xwiki/resources/js/prototype/prototype.js"></script>
<script type="text/javascript"
src="/xwiki/bin/skin/resources/js/xwiki/xwiki.js"></script>
<script type='text/javascript'
src='/xwiki/bin/skin/resources/js/smartclient/initsc.js'></script>
<script type='text/javascript'
src='/xwiki/resources/js/smartclient/modules/ISC_Core.js'></script>
<script type='text/javascript'
src='/xwiki/resources/js/smartclient/modules/ISC_Foundation.js'></script>
<script type='text/javascript'
src='/xwiki/resources/js/smartclient/modules/ISC_Containers.js'></script>
<script type='text/javascript'
src='/xwiki/resources/js/smartclient/modules/ISC_Grids.js'></script>
<script type='text/javascript'
src='/xwiki/resources/js/smartclient/modules/ISC_Forms.js'></script>
<script type='text/javascript'
src='/xwiki/resources/js/smartclient/modules/ISC_DataBinding.js'></script>
<script type='text/javascript'
src='/xwiki/resources/js/smartclient/skins/Enterprise/load_skin.js'></script>
<script type='text/javascript'
src='/xwiki/bin/skin/resources/js/xwiki/xwikiexplorer/xwikiexplorer.js'></script>
<script type="text/javascript" src="xwe.nocache.js"></script>
</head>
<body>
<button onclick="load(this)">Load</button>
<script type="text/javascript">
function load(hook) {
// Create a plain text area.
var textArea = document.createElement('textarea');
textArea.id = 'demo';
textArea.rows = 25;
textArea.cols = 80;
hook.parentNode.replaceChild(textArea, hook);
// Create a new editor instance.
new WysiwygEditor({
hookId: 'demo',
syntax: 'xwiki/2.0',
displayTabs: true,
defaultEditor: 'wysiwyg',
plugins: 'submit line separator text valign list indent history
format symbol link image table macro import',
menu: 'link image table macro import',
debug: true
});
}
</script>
</body>
</html>
What should I do? Thank you for your help!
Jue Wang
Hi Marius,
I compiled my code, but all the buttons are invisible and uncaught exception
came up:
[ERROR] Uncaught exception escaped
java.lang.RuntimeException: Failed to invoke native method:
@org.xwiki.gwt.dom.client.Event::isCancelled() with 0 arguments.
at com.google.gwt.dev.shell.moz.LowLevelMoz.invoke(LowLevelMoz.java:134)
at
com.google.gwt.dev.shell.moz.ModuleSpaceMoz.doInvoke(ModuleSpaceMoz.java:99)
at com.google.gwt.dev.shell.ModuleSpace.invokeNative(ModuleSpace.java:453)
at
com.google.gwt.dev.shell.ModuleSpace.invokeNativeBoolean(ModuleSpace.java:146)
at
com.google.gwt.dev.shell.JavaScriptHost.invokeNativeBoolean(JavaScriptHost.java:35)
at org.xwiki.gwt.dom.client.Event$.isCancelled$(Event.java)
at
org.xwiki.gwt.user.client.ui.rta.internal.BehaviorAdjuster.onBrowserEvent(BehaviorAdjuster.java:123)
at
org.xwiki.gwt.user.client.ui.rta.RichTextArea.onBrowserEvent(RichTextArea.java:154)
at com.google.gwt.user.client.DOM.dispatchEventImpl(DOM.java:1320)
at com.google.gwt.user.client.DOM.dispatchEventAndCatch(DOM.java:1299)
at com.google.gwt.user.client.DOM.dispatchEvent(DOM.java:1262)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at com.google.gwt.dev.shell.MethodAdaptor.invoke(MethodAdaptor.java:103)
at
com.google.gwt.dev.shell.moz.MethodDispatch.invoke(MethodDispatch.java:80)
at org.eclipse.swt.internal.gtk.OS._g_main_context_iteration(Native Method)
at org.eclipse.swt.internal.gtk.OS.g_main_context_iteration(OS.java:1428)
at org.eclipse.swt.widgets.Display.readAndDispatch(Display.java:2840)
at
com.google.gwt.dev.SwtHostedModeBase.processEvents(SwtHostedModeBase.java:235)
at com.google.gwt.dev.HostedModeBase.pumpEventLoop(HostedModeBase.java:558)
at com.google.gwt.dev.HostedModeBase.run(HostedModeBase.java:405)
at com.google.gwt.dev.HostedMode.main(HostedMode.java:232)
Here is the visual:
https://docs.google.com/Doc?docid=0AUvGk3CNC6BPZGhwZGQ1M3dfNDNnNDQ5emZmNw&h…
Could you please help me take a look at it. Thank you, Marius!
Jue Wang