Code blocks are not sanitized during excerpt generation. Unintended script execution possible.

[cathysarisky]

Issue Summary

If the user creates a code block in the Ghost editor (old or beta version) at the very start of the post, and does not set a custom_excerpt, the excerpt generated can lead to unintended injection of any scripts onto the homepage.

A simple example:
Post looks like this:

Front page (Ruby) renders that like this:

[Not just a Ruby problem. Can repro in any theme with an excerpt on the index page]

Steps to Reproduce

Create a post. Start it with a code card. Start the code card with a script tag. Using a theme that displays excerpts on the front page, navigate to the front page.

Ghost Version

5.51

Node.js Version

on Ghost Pro

How did you install Ghost?

Ghost Pro

Database type

MySQL 8

Browser & OS version

Chrome, Windows 10, recent.

Relevant log / error output

see above - and yes, that shows up in my console logs!

Code of Conduct

• I agree to be friendly and polite to people in this repository

[joeldesante]

I can confirm this bug is reproducible.

NodeJS v18
Ghost v5.53.3
Browser: Firefox 114.0.1

--

I'd like to look into fixing this if that's okay!

[cathysarisky]

Just a note that this bug is still live. Just tested on Source. The excerpt is correctly escaped on the individual post page, but the index page can still be injected.