From: Thomas Waldmann <tw@waldmann-edv.de>
Date: Mon, 26 Oct 2020 21:18:34 +0100
Subject: security: fix stored XSS vulnerability via SVG attachment
Origin: https://github.com/moinwiki/moin-1.9/commit/64e16037a60646a4d834f0203c75481b9c3fa74c
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2020-15275

Fixes CVE-2020-15275.

An attacker with write permissions can upload an SVG file that contains
malicious javascript. This javascript will be executed in a user's
browser when the user is viewing that SVG file on the wiki.

Components of this fix:

A) add svg mimetype to the XSS endangered types

   SVG can contain javascript and lead to stored XSS.

   Seems like the only exception to that is when using it in an
   <img> tag as src.

B) add svg+xml to the browser supported image types

   This triggers that moin will use the <img> tag for SVGs.

   <img> does not have the SVG XSS issue.

Credits:

This vulnerability was discovered by:

Catarina Leite from the Checkmarx SCA AppSec team
---
 MoinMoin/config/__init__.py    | 2 +-
 MoinMoin/config/multiconfig.py | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

Index: moin-1.9.9/MoinMoin/config/__init__.py
===================================================================
--- moin-1.9.9.orig/MoinMoin/config/__init__.py	2020-11-10 14:57:04.816568383 +0100
+++ moin-1.9.9/MoinMoin/config/__init__.py	2020-11-10 14:57:04.812568185 +0100
@@ -12,7 +12,7 @@
 from MoinMoin.util.chartypes import *
 
 # List of image types browser do support regulary
-browser_supported_images = ('gif', 'jpg', 'jpeg', 'png', 'bmp', 'ico', )
+browser_supported_images = ('gif', 'jpg', 'jpeg', 'png', 'bmp', 'ico', 'svg+xml')
 
 # Parser to use mimetype text
 parser_text_mimetype = ('plain', 'csv', 'rst', 'docbook', 'latex', 'tex', 'html', 'css',
Index: moin-1.9.9/MoinMoin/config/multiconfig.py
===================================================================
--- moin-1.9.9.orig/MoinMoin/config/multiconfig.py	2020-11-10 14:57:04.816568383 +0100
+++ moin-1.9.9/MoinMoin/config/multiconfig.py	2020-11-10 14:57:04.812568185 +0100
@@ -1137,6 +1137,7 @@
     ('mimetypes_xss_protect',
      [
        'text/html',
+       'image/svg+xml',
        'application/x-shockwave-flash',
        'application/xhtml+xml',
      ],
