Recently I discovered that MODx site might be led to crash by requesting pages comprising a call of Jot snippet. Malicious scripts add to the query string something like "?somevariable[]=somevalue". Jot analyzes this extended string and crashes while executing urlencode() function on url’s component being an array instead of expected string. Below is a Jot’s function preserveUrl() with weak piece of code patched:
function preserveUrl($docid = '', $alias = '', $array_values = array(), $suffix = false) {
global $modx;
$array_get = $_GET;
$urlstring = array();
unset($array_get["id"]);
unset($array_get["q"]);
$array_url = array_merge($array_get, $array_values);
foreach ($array_url as $name => $value) {
if (!is_null($value)) {
#### WEAK PIECE OF CODE ####
####$urlstring[] = $name . '=' . urlencode($value);
$urlstring[] = $name . '=' . urlencode((is_array($value) ? implode('', $value) : $value));
####
}
}
$url = join('&',$urlstring);
if ($suffix) {
if (empty($url)) { $url = "?"; }
else { $url .= "&"; }
}
return $modx->makeUrl($docid, $alias, $url);
}
On my site (
http://setpro.net.pl/software/modx-stuff) I am providing code of entire Jot classes with above correction applied - ver. 1.1.2, 1.1.3, and 1.1.4. Code on my site also includes another patch that is described in the article.
MODX Staff