CSS injection vulnerabilities

[jamesknelson]

Rebass is currently vulnerable to CSS injection vulnerabilities.

If a malicious user is able to feed props into Rebass components on a page that a target user is viewing, they can inject any styles they'd like into the target's page.

This can result in defacing your app/website, capturing keystrokes in fields, finding the characters used in a certain HTML element, or in the case of IE9, possibly even arbitrary JavaScript execution.

As an example, you can change the background color of the page via the text of a Tooltip element:

<Tooltip text='hello";} html:not(&) {background-color: blue;}  .test'>
  <Text>
    Hover Me
  </Text>
</Tooltip>

I've got a live version on codesandbox.

Using the same approach, you can execute any of the attacks linked above. Also, the problem isn't limited to tooltips; every prop that feeds into a CSS block is vulnerable.

Not sure how to approach fixing this, but given that most vulnerable props are numbers, you could strip out all double quote " and brace { } characters? This would mean reimplementing the tooltip to avoid the CSS content selector, though.

[jxnblk]

Correct me if I'm wrong, but this is only an issue if you allow users to pass props to the React component (which you shouldn't do), right? I think the styled-components docs warn about this but I'd have to look it up

[jamesknelson]

It should be ok to pass user input to props in most cases. When it isn't ok, it should be made obvious (like the dangerouslySetInnerHTML prop in React).

The styled-components docs do mention not to inject user input without sanitising it first, but that is the responsibility of the component itself, not the parent.

[jxnblk]

I guess I've never really worked on an app where user input is being used as a prop – and sorta would guess that a responsible dev would sanitize user input before doing anything like that. Might be worth putting a note in the docs, but I have no idea how many people would do something like that. Maybe my assumption about devs being generally aware of XSS vulnerabilities isn't accurate? Regardless, I don't think sanitation belongs in a library like Rebass

[trusktr]

App devs should be aware, yeah, but the benefit of putting sanitation in a lib seems to be that then it doesn't matter if the devs aren't.