Docs site: unescaped template/Markdown HTML (stored XSS surface)

Abierto
  • ¿Algo no está bien?
#4,972 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
15/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
html, javascript, jquery, markdown
Área
documentation, frontend, security

Línea de trabajo

Start with web/static_content/html/tutorial_template.html around line 50, where the YouTube ID is interpolated into jQuery HTML, then check web/static_content/html/include/head.html at lines 13 and 18 for the {{$PAGE_URL}} and {{$PAGE_TITLE}} substitutions. The thread disputes whether the Markdown link path is reachable, and the template renderer lives in a submodule absent from this checkout. Done means the escaping behaviour is confirmed and the fix is agreed with maintainers, so treat this as a security triage task rather than a quick patch.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

The tutorial template interpolates a captured YouTube ID into an HTML string passed to jQuery; head/sidebar/footer templates and the Markdown pipeline emit raw HTML. A malicious page/URL can persist script content into the published site served from kframework.org.

3 finding(s) (2 MEDIUM, 1 LOW) — line-anchor verified at commit 4a46d1231473.

Findings
Severity ID Location Summary
MEDIUM web-misc-001 web/static_content/html/tutorial_template.html:50 DOM XSS sink: unescaped YouTube ID interpolated into jQuery HTML in tutorial template
MEDIUM web-misc-002 web/static_content/html/include/head.html:13 Unescaped template variable {{$PAGE_URL}} injected into rel=canonical href
LOW web-misc-003 web/static_content/html/include/head.html:18 Unescaped template variable {{$PAGE_TITLE}} injected into <title>
Details
web-misc-001 — DOM XSS sink: unescaped YouTube ID interpolated into jQuery HTML in tutorial template (web/static_content/html/tutorial_template.html:50)

Trigger (as reviewed): The tutorial template iterates over every anchor in .markdown-preview and, for any href matching ^https?://youtu.be/(.+?)$, takes the raw capture group youtubeId and interpolates it verbatim into an HTML string that is handed to jQuery $(...) and inserted via replaceWith. The regex anchors only the prefix and end-of-string and does not restrict the character set of the capture group, so a Markdown link target such as https://youtu.be/"> survives the match and lands inside the src="..." attribute of the generated markup.

Impact (as reviewed): The generated markup is parsed by jQuery's HTML parser and inserted into the live page. Because the attacker-controlled value is placed inside a double-quoted attribute with no attribute encoding, an injected quote plus tag/event-handler payload breaks out of the attribute and creates new elements; onerror-style handlers fire on insertion in the real kframework.org origin, giving stored XSS from merged documentation content.

Deep review: reachability=REACHABLE-FROM-UNTRUSTED; exploitability=THEORETICAL; red-team=RED-TEAM-SURVIVED.

Strongest counterargument found during red-teaming: The finding's stated trigger is wrong as written: markdown-it 12.3.2 normalizeLink -> [email protected] encode percent-encodes ", < and > in every Markdown link destination, so [x](https://youtu.be/"><img src=x onerror=alert(1)>) lands in the DOM as %22%3E%3Cimg... and cannot break out of the src attribute. The sink is reachable only because k-web-theme sets html:true with no sanitizer, so the payload must arrive as an entity-encoded raw-HTML anchor (or a markdown-it-attrs {href=...} override), which makes this line a redundant second-order sink rather than the root cause; that root cause (raw HTML passed through unchecked) would allow <img onerror> injection without this template at

web-misc-002 — Unescaped template variable `{{$PAGE_URL}}` injected into `rel=canonical` href (web/static_content/html/include/head.html:13)

Trigger (as reviewed): {{$PAGE_URL}} is substituted by the k-web-theme site generator from page metadata and placed directly inside an attribute value with no HTML-attribute escaping in this template. If the page URL/metadata can be influenced by a contributor and contains a quote or angle bracket, the attribute is broken out of and arbitrary markup is injected into every generated page header.

Impact (as reviewed): Injected markup executes in the kframework.org origin for every visitor of the affected page (stored XSS) and can poison the canonical URL used by crawlers. Confirmation requires reading the k-web-theme renderer, which is a submodule absent from this checkout.

Deep review: reachability=REACHABLE-FROM-UNTRUSTED; exploitability=THEORETICAL; red-team=VERIFIABLE-UNKNOWN.

web-misc-003 — Unescaped template variable `{{$PAGE_TITLE}}` injected into `<title>` (web/static_content/html/include/head.html:18)

Trigger (as reviewed): {{$PAGE_TITLE}} is written inside <title> with no HTML escaping in the template; the value is derived from page metadata during generatePagesFromMarkdownFiles. A title containing </title><script>...</script> breaks out of the title element.

Impact (as reviewed): Persistent script execution on the published docs site in the kframework.org origin, plus a malformed document head for all visitors of the affected page. Escaping responsibility lives in k-web-theme and needs confirmation.

Deep review: reachability=REACHABLE-INTERNAL-ONLY; exploitability=EXPLOITABLE; red-team=VERIFIABLE-UNKNOWN.

Suggested fix

Escape template variables in attribute/text contexts, and sanitize (or explicitly restrict) raw HTML rendered from Markdown before publishing.

Related

Intra-repo sibling references for lines in this bundle: web-misc-003.

From a static audit of this repository at commit 4a46d1231473b599c699160132fd6e76a5c46406 (master). Every location above was verified against the source at that revision; no exploit code was run against this repository or its infrastructure.

Lenguaje dominante
Python
Estrellas
605
Forks
165
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de runtimeverification/k

Todos los issues de runtimeverification/k

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.