LoginSign Up
← Back to all sparks
O

Open edX

EDTECH
Velocity5.0

Open-source learning platform powering massive open online courses

openedx.org ↗

Open edX closes a stored-script hole in course certificates on both supported release lines

lmsopen-sourcesecuritybackportsxss
◆Current state
Open edX's visible stream is release-branch commits, and every recent one is corrective. The October fix stops course authors from planting script in certificate pages through an Advanced Setting that was merged into the certificate context unescaped, and it landed on verawood and ulmo within the same minute. July's entries closed an authorization gap on the course-team endpoint the same way, one fix per branch.
◆Where it's heading
The work pattern is security backports to the two named branches operators actually run, not feature delivery. Fixes increasingly target trust boundaries inside a course: what an author or an enrolled learner can reach that they should not.
◆Prediction
More paired backports to verawood and ulmo are the likeliest next entries; nothing in the feed points to a feature release.

◆Recent moves

  1. 15d ago

    Certificate overrides escaped to stop author-planted script

    Certificate pages now escape values that course authors can override, closing a path for an author to run script on the LMS origin for anyone viewing a certificate. Script-executing URLs are dropped outright, since escaping cannot neutralise them. It continues the run of trust-boundary fixes on the release branches.

    View source ↗
  2. 15d ago

    Certificate escaping fix backported to ulmo

    The same certificate-escaping fix, applied to the ulmo branch in the same minute. Operators on the older line get the protection without upgrading.

    View source ↗
  3. 3mo ago

    Course-team endpoint gated behind manage permission

    The support course-team GET endpoint required only authentication, so any enrolled learner could call it and read back information through response differences. Gating it on can-manage closes a real exposure on the newest release branch.

    View source ↗
  4. 3mo ago

    Same authorization fix backported to the prior branch

    The identical fix applied to the older release line a minute later. Operators track named branches rather than master, so a backport is how a fix actually reaches most installations.

    View source ↗
  5. 6mo ago

    SSRF blocked in SAML metadata URL fetching

    SAML metadata URLs are now validated to enforce HTTPS and reject loopback, link-local and reserved addresses outright, with private ranges blocked by default. Third-party auth configuration is operator-supplied, which is exactly where SSRF tends to hide.

    View source ↗
  6. 8mo ago

    LTI launch logging backported

    Additional logging around the LTI launch flow, backported to a release branch. Diagnostic support for integration debugging with no user-visible effect.

    View source ↗