mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-05 00:29:48 +03:00
Stored Cross-Site Scripting #484
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @prodigysml on GitHub (Oct 26, 2017).
Originally assigned to: @ssddanbrown on GitHub.
For Bug Reports
Expected Behavior
Filter out JS code. Any author can write Cross-site scripting payloads and cause issues for the users/
Current Behavior
JS code is not filtered within the page creation
Steps to Reproduce
<script>alert(1)</script>@ibnbay00 commented on GitHub (Nov 1, 2017):
Doesn't work on me... it's fine while I produce ur steps.
@ssddanbrown commented on GitHub (Nov 7, 2017):
Hi @ProDigySML, Thanks for opening this issue. Please could you confirm the editor you're using? Markdown or WYSIWYG?
@prodigysml commented on GitHub (Nov 21, 2017):
@ssddanbrown The editor shouldn't really matter much to be honest (I think I was using the WYSIWYG one though). There should be some server side sanitisation in place, ensuring such bugs don't occur. Maybe something like HTML encoding the user's input may be a good way to fix it :)
@ssddanbrown commented on GitHub (Feb 20, 2018):
Huh, Looks like someone filed CVE for this:
https://www.cvedetails.com/cve/CVE-2017-1000462/
@sorvani commented on GitHub (Feb 21, 2018):
I cannot replicate this with Firefox 58.0.1 and Bookstack v0.20 when using the WYSIWYG editor.
@sorvani commented on GitHub (Feb 21, 2018):
I even tried putting it in the header. and putting it in with the "Source Code" button.
@lommes commented on GitHub (Feb 21, 2018):
Ok, let's analyze this a little closer ... I tried to reproduce this in version 0.18.0 without success, but it seems that the sanitation is done by javascript in the editor (tiny mce 4.6.2 in BookStack 0.18.0) because the script tags get remove immediately after closing the sourcecode panel. After manually manipulating the editors content before saving does remove the script-tags too, atleast they are not in the page when i edit it again.
Since this is a javascript based sanitation this might fail depending on browser and version, which, in my opinion, is not related to BookStack.
@ssddanbrown commented on GitHub (Mar 5, 2018):
Thanks everyone for the research above.
It's likely this was raised with the Markdown editor in use since JavaScript is not escaped in that.
Whether this is an issue or not really depends on how someone is using BookStack. For my own uses I quite like the idea of being able to add a little JS if required but I understand it's not ideal for non-trusted environments.
I know the easy answer here is 'Make it an option' but I like to explore all ideas and opinions otherwise 'Make it an option' is always the answer.
@ssddanbrown commented on GitHub (Mar 12, 2018):
Marked for next release. Plan to have an
.envvar to toggle<script>tag escaping on page render. Will default to on (Escaped) by default. Will run on render instead of on save to allow option toggling at any point.@ssddanbrown commented on GitHub (Mar 17, 2018):
For reference, Setting
ALLOW_CONTENT_SCRIPTS=truein the.envwill prevent escaping.