View Issue Details

This bug affects 1 person(s).
 4
IDProjectCategoryView StatusLast Update
16837Bug reportsSurvey takingpublic2021-03-10 16:42
Reportergabrieljenik Assigned Togabrieljenik  
PrioritynoneSeverityblock 
Status closedResolutionunable to reproduce 
Product Version4.3.27 
Summary16837: uploading files in chrome corrupts the response and loses the uploaded file
Description

Clone of 16656
That applied to LSv3. This for LSv4.


I have been chasing a sever bug for several days now and have finally determined what is causing it

The upload file question type does not adequately escape characters and causes truncated JSON to be stored in the database because the JSON is truncated it is near impossible to recover the uploaded file.

The survey is part of a covid 19 medical response so this bug is critical for us.

Steps To Reproduce

import the attached simple LSS file it contains 2 questions a file upload and a mandatory text field the mandatory part is critical to this bug.

Activate the survey and browse to it in chrome Version 85.0.4183.102 (Official Build) (64-bit)

Add a file

in the title field add a gt symbol e.g. t'itle

Do not enter any text into the mandatory text question

Click submit.

An error occurs close the error dialogue

Now you can see that the upload question contains damaged JSON

open the developer screen in chrome (F12)

add text to the mandatory text field

Submit the form and see what is actually submitted

This also fails in firefox however the symptoms can be a bit different (at times)

Additional Information

Problem is in all versions of Limesurvey 3 prior to 3.23.3

if you include a gt '<' symbol in either the title or the comment the displayed title and comment fields are also corrupted this may mean there is an XSS exploit possible

See attached images

TagsNo tags attached.
Bug heat4
Complete LimeSurvey version number (& build)4.3.27
I will donate to the project if issue is resolvedYes
BrowserChrome Version 85.0.4183.102
Database type & versionN/A
Server OS (if known)N/A
Webserver software & version (if known)N/A
PHP VersionN/A

Users monitoring this issue

There are no users monitoring this issue.

Activities

c_schmitz

c_schmitz

2021-03-08 23:13

administrator   ~62911

@gabrieljenik Was this also fixed for v4 ? Can this issue be closed?

gabrieljenik

gabrieljenik

2021-03-10 16:27

manager   ~63017

This issue was about special characters and used a very specific combination.
The character issue is done, couldn't reproduce it.

Stil, while trying to reproduce it, we have found some situations that may use some more digging.

Issue History

Date Modified Username Field Change
2020-11-16 19:32 gabrieljenik New Issue
2020-11-16 19:32 gabrieljenik Status new => assigned
2020-11-16 19:32 gabrieljenik Assigned To => gabrieljenik
2020-11-16 19:32 gabrieljenik Issue generated from: 16656
2021-03-03 16:01 ollehar Status assigned => feedback
2021-03-08 23:13 c_schmitz Note Added: 62911
2021-03-10 16:27 gabrieljenik Note Added: 63017
2021-03-10 16:42 c_schmitz Status feedback => closed
2021-03-10 16:42 c_schmitz Resolution open => unable to reproduce