Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Whitelist classes for HTML elements in statuses #3790

Closed
1 of 2 tasks
duxovni opened this issue Jun 16, 2017 · 5 comments · Fixed by #3810
Closed
1 of 2 tasks

Whitelist classes for HTML elements in statuses #3790

duxovni opened this issue Jun 16, 2017 · 5 comments · Fixed by #3810
Labels
bug Something isn't working

Comments

@duxovni
Copy link
Contributor

duxovni commented Jun 16, 2017

It's currently possible for a malicious OStatus server to send statuses that spoof parts of Mastodon's UI without violating the constraints of sanitize_config.rb:

<p>lewd <a class="status__content__spoiler-link" href="http://malware.ru/">Show more</a></p>
  • I searched or browsed the repo’s other issues to ensure this is not a duplicate.
  • This bug happens on a tagged release and not on master (If you're a user, don't worry about this).
@clworld clworld mentioned this issue Jun 16, 2017
Merged
@clworld clworld added security Security issues and fixes, vulnerabilities and removed security Security issues and fixes, vulnerabilities labels Jun 16, 2017
@unarist
Copy link
Contributor

unarist commented Jun 16, 2017 •
edited

Note that similar appearance can be achieved with class attribute on span element, which available before my pull request:

<p>lewd <a href="http://malware.ru/"><span class="status__content__spoiler-link">Show more</span></a></p>

Also we can embed fake link without any class attributes:

<a href="http://malware.ru/">mastodon.social/media/bPR7ghQ...</a>

@nolanlawson nolanlawson added bug Something isn't working compatibility labels Jun 16, 2017
@nolanlawson
Copy link
Contributor

Is this also the source of the "spinning" spans? I believe I saw something like <span class="fa fa-spin"></span> to achieve this.

@duxovni
Copy link
Contributor Author

duxovni commented Jun 16, 2017

Yes, that's also a result of allowing arbitrary classes in statuses; it takes advantage of FontAwesome's "spinning icons" functionality.

@nightpool
Copy link
Member

I'm working on a patch for this.

@nightpool nightpool mentioned this issue Jun 16, 2017
Merged
nightpool added a commit to nightpool/mastodon that referenced this issue Jun 16, 2017
@nightpool
Whitelist allowed classes for federated statuses
940b8f8 
Allowed classes are currently:

 - Any microformats class (h/p/u/dt/e-*)
 - the classes mention, hashtag, ellipses and invisible.

this last one is somewhat suspect, but Mastodon currently uses it to render hidden link text.

resolved mastodon#3790
Gargron pushed a commit that referenced this issue Jun 17, 2017
@nightpool @Gargron
Whitelist allowed classes for federated statuses (#3810)
94d0e01 
* Whitelist allowed classes for federated statuses

Allowed classes are currently:

 - Any microformats class (h/p/u/dt/e-*)
 - the classes mention, hashtag, ellipses and invisible.

this last one is somewhat suspect, but Mastodon currently uses it to render hidden link text.

resolved #3790

* Fix code style
@duxovni
Copy link
Contributor Author

duxovni commented Jun 17, 2017

Thanks @nightpool! This patch fixes the UI spoofing, but @unarist raised a very good point about fake links which is still unaddressed. I'll open it as a separate issue.

koteitan pushed a commit to koteitan/mastodon that referenced this issue Jun 25, 2017
@nightpool @koteitan
Whitelist allowed classes for federated statuses (mastodon#3810)
ebe093d 
* Whitelist allowed classes for federated statuses

Allowed classes are currently:

 - Any microformats class (h/p/u/dt/e-*)
 - the classes mention, hashtag, ellipses and invisible.

this last one is somewhat suspect, but Mastodon currently uses it to render hidden link text.

resolved mastodon#3790

* Fix code style
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Whitelist allowed classes for federated statuses nightpool/mastodon
5 participants
@nightpool @nolanlawson @unarist @clworld @duxovni