Task Descriptions Were Not Cleaned - edmozley/freeitsm GitHub Wiki
Fixed in 3.12.0 · Found while building the Work view for #190 · Present in every release from 1.0.0 to 3.11.0 · Module: Tasks
A task's description is formatted text (HTML). The task window and the Calendar and Timeline quick panels put it into the page without cleaning it. A description crafted to contain a script - for example a picture whose error handler runs code - ran in the browser of whoever opened the task, with that person's access.
Who could write one: anybody who can edit tasks, or a REST API key that can. And, if a workflow copies ticket text into a task, whoever raised the ticket: the Create a task workflow action fills its description from merge codes such as {{ticket.subject}} without escaping them, so a requester's email or portal ticket could supply the markup.
The Work view, added in the same release, already cleaned the description, which is how the gap was noticed.
Email bodies are cleaned before display by one shared cleaner, safeHtmlFragment() in assets/js/safe-html.js: it removes scripts, every on… attribute and javascript: links, and keeps formatting and images. Task descriptions never went through it:
-
assets/js/tasks.jsbuilt the editor with<div id="descriptionEditor">${task.description}</div>. The rich-text editor that takes over the element afterwards is no protection; the handler has already run by the time the markup is inserted. -
assets/js/tasks-quick-panel.jsshowed the description preview the same way, and the Calendar and Timeline pages did not load the cleaner at all.
Both now go through the shared cleaner - taskDescriptionHtml() in tasks.js - and fall back to plain text if the cleaner is ever missing. The Calendar and Timeline pages load safe-html.js. Formatting and pasted screenshots are kept, so nothing changes for anybody using descriptions normally. There is a TRAP: comment at both places.
Descriptions are cleaned when shown rather than when saved, as email bodies are: the server-side cleaner removes images, and analysts paste screenshots into tasks.
| File | Change | |
|---|---|---|
| 🟦 | assets/js/tasks.js |
taskDescriptionHtml(); the editor uses it |
| 🟦 | assets/js/tasks-quick-panel.js |
The preview is cleaned |
| 🟦 |
tasks/index.php, tasks/calendar/index.php, tasks/timeline/index.php
|
Load safe-html.js before the task scripts; cache-busters |
| 🟩 | tests/task-description-render.php |
New guard |
In headless Chrome, a description carrying an <img onerror>, an <svg onload> and a javascript: link: inserted the old way, both handlers fired; through the fix, none did, bold text and an embedded image survived, and with the cleaner removed the description showed as plain text. tests/task-description-render.php fails four of its seven checks on the old code and passes on the new.
No - upgrading is the fix. If you have a workflow whose Create a task action puts ticket text into the description, and you want to be sure nothing was planted, look over the tasks it created for descriptions you did not expect.
Related: Tasks · Workflow · Bugs resolved