Cypress.env() fails to escape <script></script> tags in the cypress.json file

[MarkCarbonell98]

Current behavior:

Cypress executes <script></script> tags written on the cypress.json file

<script>alert('this should not have happened')</script> gets executed while running EVERY test where Cypress.env() is called. A part of the cypress.json is logged to the browser, and the script gets executed too.

Desired behavior:

I want to safely write <script></script> tags in cypress.json for JS injection testing

I want <script></script> tags to be executed as raw text, and ones too.

Steps to reproduce: (app code and test code)

1)Go to your cypress.json, and in you env object, paste this "<script>alert('this should not have happened')</script>"
2) Create a .spec.js file and write the context() function, in the scope of the function call Cypress.env()
3) To to the Cypress tests GUI and execute the test
4) You will see the console logged "this should not have happened" and the screen will be filled with json raw data.

Versions

Chrome

[MarkCarbonell98]

tags too

CYPRESS VERSION ^3.4.1

[flotwig]

Hey @MarkCarbonell98, thanks for reporting this. It sounds like the option isn't being properly sanitized when Cypress starts, which is definitely a bug.

However, this doesn't seem like a security vulnerability because the Javascript is in control of the person who is running the tests in the first place, so there is no privilege escalation.

[flotwig]

When the Cypress runner is loaded, it embeds the config as embedded JSON, like this:

<script type="text/javascript">
Runner.start({ "env": { "foo": "<script>alert('this should not have happened')</script>" } })
</script>

Despite what the syntax highlighting on GitHub seems to show, the quoted </script> on line 2 in this actually breaks out of the <script> tag on line 1, which causes a SyntaxError that prevents tests from running.

The PR #5155 base64-encodes the config object before embedding it to prevent issues like this from occurring.

[cypress-bot]

The code for this is done in cypress-io/cypress#5155, but has yet to be released.
We'll update this issue and reference the changelog when it's released.

[cypress-bot]

Released in 3.5.0.