[mapserver-commits] [MapServer/MapServer] 47720e: OGC API Features: validate offset before rendering...

[Philip G.]

  Branch: refs/heads/branch-8-6
  Home:   https://github.com/MapServer/MapServer
  Commit: 47720e835de4d80a602210461d3b52c9f3d5c34c
      https://github.com/MapServer/MapServer/commit/47720e835de4d80a602210461d3b52c9f3d5c34c
  Author: Philip G. <44811794+PhilipPhil at users.noreply.github.com>
  Date:   2026-07-10 (Fri, 10 Jul 2026)

  Changed paths:
    A msautotest/api/expected/ogcapi_collections_mn_counties_items_offset_xss.json.txt
    M msautotest/api/ogcapi.map
    M src/mapogcapi.cpp

  Log Message:
  -----------
  OGC API Features: validate offset before rendering to fix reflected XSS (GHSA-288j-mhpj-gmmr) (#7573)

The "offset" query parameter was only parsed and validated inside the
numberMatched > 0 branch of processCollectionItemsRequest(). When a bbox
query matched zero features, that validation was skipped and the raw,
unescaped value flowed into template.params.offset, which the HTML
collection-items template renders directly into a <script> block. A
non-numeric offset (e.g. </script><img src=x onerror=alert(1)>) therefore
produced reflected XSS on any zero-match OGC API Features items request.

Parse and validate offset (integer, non-negative) unconditionally at the
start of the bbox query path, so bad values are rejected with a 400
"Bad value for offset." error before any template is rendered. The
upper-bound (offset >= numberMatched) range check stays where numberMatched
is known. Behaviour for valid offsets is unchanged.

Add an msautotest case that sends the XSS payload on a zero-match bbox with
f=html and asserts the JSON 400 error, confirming the response is
application/json rather than reflected text/html.

Co-authored-by: Philip Garabandic <pgarabandic3 at gatech.edu>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply at anthropic.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications