From 5de149fe02dcf980fa2cd9b6e08492aa3688464b Mon Sep 17 00:00:00 2001
From: Moritz 'e1mo' Fromm <git@e1mo.de>
Date: Tue, 16 May 2023 09:34:19 +0200
Subject: [PATCH] [22.11] dokuwiki: Backport xss vulnerability fix

The original update containing the fix was in #232160. Manually
creating the patch since the upstream patch is only for 2023-04-04 and
does not apply to 2022-07-31-31a.

Upstream changes and bug report:
https://github.com/dokuwiki/dokuwiki/commit/53df38b0e4465894a67a5890f74a6f5f82e827de
https://huntr.dev/bounties/c6119106-1a5c-464c-94dd-ee7c5d0bece0/
---
 .../dokuwiki/backport-rss-xss-fix.patch       | 39 +++++++++++++++++++
 pkgs/servers/web-apps/dokuwiki/default.nix    |  9 +++++
 2 files changed, 48 insertions(+)
 create mode 100644 pkgs/servers/web-apps/dokuwiki/backport-rss-xss-fix.patch

diff --git a/pkgs/servers/web-apps/dokuwiki/backport-rss-xss-fix.patch b/pkgs/servers/web-apps/dokuwiki/backport-rss-xss-fix.patch
new file mode 100644
index 000000000000..301d68f816a3
--- /dev/null
+++ b/pkgs/servers/web-apps/dokuwiki/backport-rss-xss-fix.patch
@@ -0,0 +1,39 @@
+diff --git a/inc/parser/xhtml.php b/inc/parser/xhtml.php
+index 4c2cb78b4..6cc7a9263 100644
+--- a/inc/parser/xhtml.php
++++ b/inc/parser/xhtml.php
+@@ -1347,15 +1347,11 @@ class Doku_Renderer_xhtml extends Doku_Renderer {
+                 $this->doc .= '<li><div class="li">';
+                 // support feeds without links
+                 $lnkurl = $item->get_permalink();
++                $title = html_entity_decode($item->get_title(), ENT_QUOTES, 'UTF-8');
+                 if($lnkurl) {
+-                    // title is escaped by SimplePie, we unescape here because it
+-                    // is escaped again in externallink() FS#1705
+-                    $this->externallink(
+-                        $item->get_permalink(),
+-                        html_entity_decode($item->get_title(), ENT_QUOTES, 'UTF-8')
+-                    );
++                    $this->externallink($item->get_permalink(), $title);
+                 } else {
+-                    $this->doc .= ' '.$item->get_title();
++                    $this->doc .= ' '.hsc($item->get_title());
+                 }
+                 if($params['author']) {
+                     $author = $item->get_author(0);
+@@ -1369,11 +1365,14 @@ class Doku_Renderer_xhtml extends Doku_Renderer {
+                     $this->doc .= ' ('.$item->get_local_date($conf['dformat']).')';
+                 }
+                 if($params['details']) {
++                    $desc = $item->get_description();
++                    $desc = strip_tags($desc);
++                    $desc = html_entity_decode($desc, ENT_QUOTES, 'UTF-8');
+                     $this->doc .= '<div class="detail">';
+                     if($conf['htmlok']) {
+                         $this->doc .= $item->get_description();
+                     } else {
+-                        $this->doc .= strip_tags($item->get_description());
++                        $this->doc .= hsc($desc);
+                     }
+                     $this->doc .= '</div>';
+                 }
diff --git a/pkgs/servers/web-apps/dokuwiki/default.nix b/pkgs/servers/web-apps/dokuwiki/default.nix
index e77defae33ab..cdb10600860c 100644
--- a/pkgs/servers/web-apps/dokuwiki/default.nix
+++ b/pkgs/servers/web-apps/dokuwiki/default.nix
@@ -11,6 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-gtWEtc3kbMokKycTx71XXblkDF39i926uN2kU3oOeVw=";
   };
 
+  patches = [
+    # Manually backported fix for a high severity vulnerability, allowing to inject
+    # arbitrary HTML and thus cross site scripting via RSS feeds.
+    # For reference see:
+    # https://github.com/dokuwiki/dokuwiki/commit/53df38b0e4465894a67a5890f74a6f5f82e827de
+    # https://huntr.dev/bounties/c6119106-1a5c-464c-94dd-ee7c5d0bece0/
+    ./backport-rss-xss-fix.patch
+  ];
+
   preload = writeText "preload.php" ''
   <?php