From: Thomas Waldmann <tw@waldmann-edv.de>
Date: Mon, 26 Oct 2020 21:18:34 +0100
Subject: security: fix stored XSS vulnerability via SVG attachment
Origin: https://github.com/moinwiki/moin-1.9/commit/64e16037a60646a4d834f0203c75481b9c3fa74c
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2020-15275

Fixes CVE-2020-15275.

An attacker with write permissions can upload an SVG file that contains
malicious javascript. This javascript will be executed in a user's
browser when the user is viewing that SVG file on the wiki.

Components of this fix:

A) add svg mimetype to the XSS endangered types

   SVG can contain javascript and lead to stored XSS.

   Seems like the only exception to that is when using it in an
   <img> tag as src.

B) add svg+xml to the browser supported image types

   This triggers that moin will use the <img> tag for SVGs.

   <img> does not have the SVG XSS issue.

Credits:

This vulnerability was discovered by:

Catarina Leite from the Checkmarx SCA AppSec team
---
 MoinMoin/config/__init__.py    | 2 +-
 MoinMoin/config/multiconfig.py | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/MoinMoin/config/__init__.py b/MoinMoin/config/__init__.py
index e0a4ca607462..4601d27fc0c8 100644
--- a/MoinMoin/config/__init__.py
+++ b/MoinMoin/config/__init__.py
@@ -12,7 +12,7 @@ from MoinMoin import version
 from MoinMoin.util.chartypes import *
 
 # List of image types browser do support regulary
-browser_supported_images = ('gif', 'jpg', 'jpeg', 'png', 'bmp', 'ico', )
+browser_supported_images = ('gif', 'jpg', 'jpeg', 'png', 'bmp', 'ico', 'svg+xml')
 
 # Parser to use mimetype text
 parser_text_mimetype = ('plain', 'csv', 'rst', 'docbook', 'latex', 'tex', 'html', 'css',
diff --git a/MoinMoin/config/multiconfig.py b/MoinMoin/config/multiconfig.py
index 0f03cb507225..85e628ed7f04 100644
--- a/MoinMoin/config/multiconfig.py
+++ b/MoinMoin/config/multiconfig.py
@@ -1143,6 +1143,7 @@ options_no_group_name = {
     ('mimetypes_xss_protect',
      [
        'text/html',
+       'image/svg+xml',
        'application/x-shockwave-flash',
        'application/xhtml+xml',
      ],
-- 
2.29.1

