Pager causing Reflected Cross-Site Scripting

Question

I got a PCI compliance report that raised an issue with Reflected Cross-Site Scripting on category pages.

On testing it would appear that the 'Items Per Page' drop down can be made to print some Javascript if added as a GET reqest (ie http://example.com/category.html?"<script>alert('test')</script>")

I'm using Magento 1.7.0.0. The template file I'm using (page/html/pager.phtml) is largely unchanged and when I rename it so that it falls back on the base template I get the same issue.

The issue is caused by the $this->getLimitUrl($_key) call in the select option.

From Mage_Page_Block_Html_Pager:

public function getLimitUrl($limit)
{
    return $this->getPagerUrl(array($this->getLimitVarName()=>$limit));
}

public function getPagerUrl($params=array())
{
    $urlParams = array();
    $urlParams['_current']  = true;
    $urlParams['_escape']   = true;
    $urlParams['_use_rewrite']   = true;
    $urlParams['_query']    = $params;
    return $this->getUrl('*/*/*', $urlParams);
}

Any ideas?

Answer 1

In the end I manually manipulated all the links in the template/catalog/product/list/toolbar.phtml and template/page/html/pager.phtml files so they looked something like this:

<?php $url = explode('?', $this->getPageUrl($_page)); ?>
<li><a href="<?php echo $url[0] ?>"><?php echo $_page ?></a></li>

There's certainly nothing pretty about it but it did the trick.