Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix the invalid set "You must use your LMS to access this set" message. #2640

Merged
merged 1 commit into from
Dec 3, 2024

Conversation

drgrice1
Copy link
Member

@drgrice1 drgrice1 commented Nov 26, 2024

This was broken in #2485. In that pull request line 16 of templates/ContentGenerator/ProblemSet.html.ep was changed from <p class="mb-0"><%== $c->{invalidSet} %></p> to <p class="mb-0"><%= $c->{invalidSet} %></p> which means that the invalid set message is now HTML escaped. That was necessary as almost all invalidSet messages include the set ID taken directly from the URL, and that is a cross-site scripting vulnerability. However, there is one message that does not use the set id from the URL, but does add HTML that needs to not be escaped. That is the message, You must use your Learning Management System ([_1]) to access this set. Try logging in to the Learning Management System and visiting the set from there. where the [_1] may be the LMS URL. That now displays as You must use your Learning Management System (<a href="https://myschool.edu/lms/">the LMS</a>) to access this set. Try logging in to the Learning Management System and visiting the set from there.

<%= can certainly not be changed back to <%== because of the cross-site scripting vulnerability issue. However, there is another way to prevent HTML escaping. That is by using a Mojo::Bytestream object. So this message which is the only one that needs to not be HTML escaped (and is safe to do this with) is set in that way via the b method of a Mojolicious::Controller.

This was broken in openwebwork#2485.  In that pull request line 16 of
`templates/ContentGenerator/ProblemSet.html.ep` was changed from
`<p class="mb-0"><%== $c->{invalidSet} %></p>`
to
`<p class="mb-0"><%= $c->{invalidSet} %></p>`
which means that the invalid set message is now HTML escaped.  That was
necessary as almost all `invalidSet` messages include the set ID taken
directly from the URL, and that is a cross-site scripting vulnerability.
However, there is one message that does not use the set id from the URL,
but does add HTML that needs to not be escaped.  That is the message,
`You must use your Learning Management System ([_1]) to access this set.
Try logging in to the Learning Management System and visiting the set
from there.` where the `[_1]` may be the LMS URL.  That now displays as
`You must use your Learning Management System (<a
href="https://myschool.edu/lms/">the LMS</a>) to access this set. Try
logging in to the Learning Management System and visiting the set from
there.`

`<%=` can certainly not be changed back to `<%==` because of the
cross-site scripting vulnerability issue.  However, there is another way
to prevent HTML escaping.  That is by using a `Mojo::Bytestream` object.
So this message which is the only one that needs to not be HTML escaped
(and is safe to do this with) is set in that way via the `b` method of a
`Mojolicious::Controller`.
@drgrice1 drgrice1 force-pushed the fix-lti-invalid-set-message branch from 1c864f9 to 711ea44 Compare December 3, 2024 21:28
@somiaj somiaj merged commit 4a0953f into openwebwork:develop Dec 3, 2024
2 checks passed
@drgrice1 drgrice1 deleted the fix-lti-invalid-set-message branch December 3, 2024 21:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants