Fix JavaScript encoding issue #858
Conversation
Properly fix the old XSS bug: store the raw value in DB (so that actual JS can be executed), and sanitize it when displaying it on the main page.
Codecov ReportBase: 55.35% // Head: 55.15% // Decreases project coverage by
Additional details and impacted files@@ Coverage Diff @@
## master #858 +/- ##
============================================
- Coverage 55.35% 55.15% -0.20%
Complexity 893 893
============================================
Files 175 176 +1
Lines 4482 4498 +16
Branches 587 587
============================================
Hits 2481 2481
- Misses 1839 1855 +16
Partials 162 162
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. ☔ View full report at Codecov. |
|
@bennetelli If you have any questions, please don't hesitate to ask 😉 Just to be clear, this adds a way to sanitize the HTML passed to the template engine, using the |
| ${foreach feature.strategy.parameters param} | ||
| ${if param.hasValue} | ||
| <li>${param.label}: ${param.value}</li> | ||
| <li>${param.label}: ${param.value;sanitizeHtml}</li> |
There was a problem hiding this comment.
Yet that's the official JMTE syntax:
- https://www.tinymediamanager.org/docs/jmte#renderer-information
- https://code.google.com/archive/p/jmte/wikis/BestOfAPI.wiki
It uses the renderer name (here sanitizeHtml) defined in SanitizeHtmlRender.java
There was a problem hiding this comment.
And yes it works, I tested on my machine, the custom renderer is called, and it prevents XSS on the main page, when displaying the script ;)
There was a problem hiding this comment.
Okay thanks :) the syntax looks a bit weird.
Thanks for your PR :)
Actually fixes #849
The issue was: we encoded the JS script before saving it, therefore making it corrupted (& became &, etc.).
Now, we store the raw JS sent by the client in DB, and only when DISPLAYING the value, we sanitize it to prevent XSS.
Please tell me if there's another XSS issue somewhere, because apart from the main page, I didn't think of anything else ;)