Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

DOM extractor output contains JS that can be executed upon viewing, and is subject to same security risks as viewing WGET output #1261

Closed
p0n1 opened this issue Nov 3, 2023 · 1 comment
Closed

DOM extractor output contains JS that can be executed upon viewing, and is subject to same security risks as viewing WGET output #1261

p0n1 opened this issue Nov 3, 2023 · 1 comment

Comments

@p0n1
Copy link

p0n1 commented Nov 3, 2023

I noticed the following descriptions on executing archived JS.

Note: Only the wget extractor method executes archived JS when viewing snapshots, all other archive methods produce static output that does not execute JS on viewing. If you are worried about these issues ^ you should disable the wget extractor method using archivebox config --set SAVE_WGET=False.

Source: https://github.com/ArchiveBox/ArchiveBox#security-risks-of-viewing-archived-js

Workarounds
Disable the wget extractor by setting archivebox config --set SAVE_WGET=False, ensure you are always logged out, or serve only a static HTML version of your archive.

Source: GHSA-cr45-98w9-gwqx

I think the the SAVE_DOM archive method could also lead to the similar issue. When viewing Chrome > HTML ./output.html, any remote javascript will be loaded and executed.

Is that right? If so, we should also document this and remind users to disable this option if they should worry about the XSS/CSRF issue.
@pirate
Copy link
Member

pirate commented Nov 4, 2023 •
edited
Loading

You're right, it used to be stripped before we expanded it to be the full outerHTML with <head>, but it I didn't realize it became included when we changed that. Good catch, thanks!

I updated the CVE GHSA-cr45-98w9-gwqx CVE-2023-45815, README.md, and Security Overview Wiki page.

@pirate pirate closed this as completed Nov 4, 2023
@pirate pirate changed the title Description on archived Javascript DOM extractor output contains JS that can be executed upon viewing, and is subject to same security risks as viewing WGET output Nov 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@pirate @p0n1