XSS fixes

[jesusbagpuss]

@goetzk - with your release, thought it worth highlighting this:
eprints#95

I'll add some code today for review

[jesusbagpuss]

See experimental fixes on https://github.com/eprintsug/irstats2/tree/issue-17-xss

Notes:

• some parts of IRStats (cgi scripts) seem to allow for date formats such as yyyy/mm/dd. The parameter validation methods added to the branch above don't allow this.
• I think the method EPrints::Plugin::Stats::Utils::range_to_offset is un-used, and possible should be removed?

[jesusbagpuss]

There may be other changes/improvements in how the cgi scripts read params - possibly replacing methods with a call to the Context module.

[jesusbagpuss]

NB I've also spotted that the base_url param in cgi/stats/set_finder (called from javascript) needs work.

[cziaarm]

'xcuse my lack of ability in the dark-arts, but is dealing with the paramaters at the point they are written into the script tag

https://github.com/eprints/irstats2/blob/master/lib/plugins/EPrints/Plugin/Stats/Context.pm#L320

an overly simple fix?

It doesn't stop all sorts of cruft getting injected into various bits of html, but might keep it from getting executed?

[cziaarm]

...Unless someone manages to escape from an attribute and shoehorn an entire script tag in there... I think the more fulsome approach is probably the wisest on reflection. As you were...

[jesusbagpuss]

Some params get passed via the javascript ajax params/context.

Below is hopefully a definitive list. The 'context' params get sanitised in the proposed code in https://github.com/eprintsug/irstats2/blob/issue-17-xss/lib/plugins/EPrints/Plugin/Stats/Context.pm.

The validation methods could be lifted into the EPrints::Plugin::Stats::Util module to make calling them from the cgi scripts more sensible.

• 'context' params:
  • datatype
  • datafilter
  • grouping
  • set_name
  • set_value
  • range
  • to
  • from
• limit
• q (searching for sets)
• base_url
• view
• top
• title_phrase
• referer (https://github.com/eprintsug/irstats2/edit/issue-17-xss/cgi/stats/browse - although that may be a redundant file?)
• container_id (could try to normalise these - to all start with 'irstats2_'?):
  • spark_[eprintid]
  • irstats2_summary_page_downloads
  • irstats2_summary_page_countries
  • stats_browse_test !?
  • irstats2_downloads
  • irstats2_top5
  • irstats2_container_[xxxxxx]
  • downloads
  • hits
  • deposits
  • total_fulltext
  • total_openaccess
  • lm_downloads (L M == last month)
  • lm_deposits
  • ratio_fulltext
  • ratio_openaccess

THis: https://github.com/eprintsug/irstats2/blob/issue-17-xss/cgi/stats/get#L78-L83 will need to understand expected params that are outside the context params.