Opened 10 years ago

Closed 10 years ago

#2072 closed defect (fixed)

Potlatch doesn't do server-side validation of client-supplied data which can result in invalid data in the database

Reported by: avar Owned by: richard@…
Priority: major Milestone:
Component: potlatch (flash editor) Version:
Keywords: Cc:

Description

This is related to ticket:1936 which fixed one vector, but Potlatch still doesn't do server-side validations of user-supplied data so the issue could return in other circumstances, either due to a client bug or a malicious user.

The bug surfaces for example in this issue in which data entered into Potlatch caused a minutely changeset to be invalid XML.

So Potlatch should, upon getting user-submitted data:

  • Check if it's valid UTF-8, the railsport already has a function for this.

But that would still break things because the main API only accepts a subset of UTF-8 due it also doing incidental validation [http://lists.openstreetmap.org/pipermail/dev/2009-July/016165.html with its XML parser.

So the spec needs to be made clearer on which subset of UTF-8 is accepted. But meanwhile Potlatch should take the conservative approach and reject the control characters that the main API refuses.

Change History (4)

comment:1 Changed 10 years ago by Richard

Priority: criticalmajor

"Potlatch still doesn't do server-side validations of user-supplied data" is a contradiction in terms, Potlatch doesn't run server-side. You mean amf_controller. ;)

I believe Matt suggested a fix in #1936 - you could try applying it.

comment:2 in reply to:  1 Changed 10 years ago by avar

Replying to Richard:

"Potlatch still doesn't do server-side validations of user-supplied data" is a contradiction in terms, Potlatch doesn't run server-side. You mean amf_controller. ;)

I mean amf_controller, which for all intents and purposes is the server side of Potlatch since it's not a public API and Potlatch is the only thing that uses it.

I believe Matt suggested a fix in #1936 - you could try applying it.

I'm not interested in spending time on it myself since I haven't had to directly deal with Potlatch's corrupt data, so the itch-to-scratch factor isn't there. But it's an issue I've noted that a bug wasn't filed for, hence this ticket.

comment:3 Changed 10 years ago by Richard

Understood.

http://www.geowiki.com/halcyon/ uses either AMF or XML (depending on user configuration).

comment:4 Changed 10 years ago by Richard

Resolution: fixed
Status: newclosed

Has been fixed by Matt, I believe.

Note: See TracTickets for help on using tickets.