Checkout barcode CQL injection

Description

Overview:
Barcode should be quoted and masked when building the CQL query.
Steps to Reproduce:

  • Open Checkout app

  • Select an active user

  • Enter one of these barcodes into the barcode slot:

  • Press enter or click the enter button

Expected Result:
Back-end call with properly quoted and masked CQL query:

query urldecoded:

Actual Result:

Query urldecoded:

The first two queries cause an error popup saying: "org.folio.cql2pgjson.exception.QueryValidationException: org.z3950.zing.cql.CQLParseException: expected boolean, got '/'" or "... got '('"
The third query incorrectly searches for abc\def because the first backslash masks the second one.

Additional Information:

  1. mask \ and " using https://github.com/folio-org/stripes-util/blob/v3.0.0/lib/escapeCqlValue.js

  2. put string into double quotes: barcode=="abc(2)"

CSP Request Details

None

CSP Rejection Details

None

Potential Workaround

None

Checklist

hide

TestRail: Results

Activity

Show:

Julian LadischJune 26, 2020 at 4:24 PM

There is no need for a Goldenrod backport.

Julian LadischJune 25, 2020 at 1:12 PM

This is fixed and works perfectly.

(The

test case reveals a bug in the back-end; this is a separate issue – the front-end masking is perfect and this issue can be closed as done.)

Cate BoeremaJune 24, 2020 at 4:53 PM

can you please test this? Does this need to be backported to Goldenrod?

Done

Details

Assignee

Reporter

Priority

Story Points

Sprint

Development Team

Prokopovych

Fix versions

TestRail: Cases

Open TestRail: Cases

TestRail: Runs

Open TestRail: Runs

Created June 18, 2020 at 3:11 PM
Updated March 17, 2023 at 7:16 AM
Resolved June 29, 2020 at 1:06 PM
TestRail: Cases
TestRail: Runs