Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

JavaScript injection vulnerability #880

Closed
freekmurze opened this issue Jul 13, 2019 · 5 comments
Closed

JavaScript injection vulnerability #880

freekmurze opened this issue Jul 13, 2019 · 5 comments

Comments

@freekmurze
Copy link

When somebody creates a webmention by tweeting some JavaScript code, that JavaScript code is actually being executed.

You can find an example on my account: https://brid.gy/twitter/freekmurze

Look for the interaction with this tweet: https://twitter.com/enunomaduro/status/1150157457664008192

image
@snarfed
Copy link
Owner

snarfed commented Jul 14, 2019

yow, thanks for finding and reporting! will fix.

@snarfed
Copy link
Owner

snarfed commented Jul 14, 2019 •
edited
Loading

fortunately, bridgy has no login, user sessions, or any other browser-side credentials or state that could be exploited with this.... but still, definitely worth fixing regardless.

@freekmurze
Copy link
Author

Thanks for taking care of this and also thank you for having created this neat service 👍

snarfed added a commit that referenced this issue Jul 15, 2019
@snarfed
escape misc user-generated HTML displayed on user pages
34e8151 
fixes XSS in #880
@snarfed
Copy link
Owner

snarfed commented Jul 15, 2019

thanks again @freekmurze!

@snarfed snarfed closed this as completed Jul 15, 2019
@snarfed
Copy link
Owner

snarfed commented Jul 15, 2019

example: https://brid.gy/twitter/freekmurze?responses_before=2019-07-14T01:08:21.055275#responses

note the escaped <script>alert("Hey buddy")</script> text.

snarfed added a commit to snarfed/webutil that referenced this issue Jul 16, 2019
@snarfed
pretty_link: URL- and HTML-escape < and > chars in URLs
2e59180 
helps prevent XSSes. for snarfed/bridgy#880
snarfed added a commit to snarfed/granary that referenced this issue Jul 16, 2019
@snarfed
Source.embed_post(): URL-escape url since it's rendered in HTML
560ebef 
for snarfed/bridgy#880
snarfed added a commit that referenced this issue Jul 16, 2019
@snarfed
test and document more HTML-escaping to prevent XSSes
c1a400e 
for #880
@snarfed snarfed mentioned this issue Apr 23, 2020
Closed
jamietanna added a commit to jamietanna/bridgy that referenced this issue Apr 23, 2020
@jamietanna
Fix: Escape HTML tags in content
de471a0 
As part of snarfed#880, we added a check to ensure that we would not be subject
to Cross-Site Scripting attacks (XSS).

However, as noted in snarfed#936, a post that does contain HTML is still being
rejected.

The simplest way to get around this is to escape the tags with the HTML
entities corresponding with them, so they can be safely rendered.

Closes snarfed#936.
This was referenced Apr 23, 2020
Closed
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@freekmurze @snarfed