New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix XSS #2159

Closed

antimatter15 wants to merge 1 commit into proofcarryingdata:main from antimatter15:patch-1

antimatter15 commented Nov 12, 2024

No description provided.


          Fix XSS

b210911

artwyman mentioned this pull request

Format error messages as text to avoid XSS vulnerabilities #2161

Merged

Collaborator

artwyman commented Nov 12, 2024

Thanks for you help tracking this down @antimatter15! See #2161 for a broader version of this.

antimatter15 closed this

github-merge-queue bot pushed a commit that referenced this pull request


          Format error messages as text to avoid XSS vulnerabilities (#2161)

b34222c

Mark error messages from api.zupass.org as text to ensure any <script>
tags in them are not executed. Those could come directly from user
input.

This was reported by Andrew (a different one, not me) at Devcon. The
risk here is low since api.zupass.org is a different domain with no
sensitive data in cookies or local storage, but still good to clean up
the risk that users could be tricked into something dangerous.

Two test URLs which demonstrate script injection via URL parameters on
api.zupass.org:

```
https://api-staging.zupass.org/sync/v3/load?blobKey=%3Cscript%3Ealert(%22andrewwashere%22)%3C%2fscript%3E

https://api.zupass.org/generic-issuance/api/feed/19ffc405-742f-4485-a831-2ea7e987666d/zu-thailand%3Cscript%3Ealert(%60Cookies%3A%20%24%7Bdocument.cookie%7D%2C%20LocalStorage%3A%20%24%7BJSON.stringify(localStorage)%7D%60)%3C%2Fscript%3E
```

Here are versions of those URLs which demonstrate the issue on my local
test server:

```
http://localhost:3002/sync/v3/load?blobKey=%3Cscript%3Ealert(%22andrewwashere%22)%3C%2fscript%3E

http://localhost:3002/generic-issuance/api/feed/d16ddd24-0155-4244-8799-80f2c4afdc5f/0%3Cscript%3Ealert(%60Cookies%3A%20%24%7Bdocument.cookie%7D%2C%20LocalStorage%3A%20%24%7BJSON.stringify(localStorage)%7D%60)%3C%2Fscript%3E
```

Attn: @antimatter15 who submitted an initial version of this in #2159 .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet