prqlc Debug Report HTML Does Not Escape Source File Name, Enabling Stored XSS via PRQLC_DEBUG_LOG

Aperta Adatta ai principianti
  • Qualcosa non va?
#6,502 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
75/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
security

Direzione di ricerca

Inizia da prqlc/prqlc/src/debug/render_html.rs, in particolare da write_repr_prql() e write_key_values(), dove l’issue individua la visualizzazione dei percorsi e l’ordine dell’escaping. Controlla i test esistenti per l’escaping HTML e aggiungi casi per un nome di file che contenga una barra inversa e una virgoletta doppia. Il lavoro è completato quando il report di debug visualizza quel percorso senza consentire l’esecuzione di HTML iniettato.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
What happened?

prqlc's debug-report renderer write_repr_prql() in prqlc/prqlc/src/debug/render_html.rs correctly HTML-escapes the source contents it embeds in <code id="source-{id}">, but the file path rendered one line earlier by write_key_values(w, &[("path", &path), ...]) is passed through escape_html(&format!("{v:?}")), i.e. escape_html is applied to the Debug representation of the PathBuf rather than to the raw path string. For a file name containing both a backslash and a double quote, the Debug formatter first turns the quote into \", after which escape_html emits the backslash literally. The HTML parser then treats that backslash as a literal \ followed by a real attribute-closing quote, breaking out of the attribute context and allowing an attacker-controlled <svg/onload=...> (or any tag) to execute in the context of the debug report. Because the report is generated by design and is commonly treated as a trusted, shareable artifact (support troubleshooting, issue attachments, docs sites), the injection lands in a high-trust product.

PRQL input
prqlc's debug-report renderer `write_repr_prql()` in `prqlc/prqlc/src/debug/render_html.rs` correctly HTML-escapes the source *contents* it embeds in `<code id="source-{id}">`, but the *file path* rendered one line earlier by `write_key_values(w, &[("path", &path), ...])` is passed through `escape_html(&format!("{v:?}"))`, i.e. `escape_html` is applied to the `Debug` representation of the `PathBuf` rather than to the raw path string. For a file name containing both a backslash and a double quote, the `Debug` formatter first turns the quote into `\"`, after which `escape_html` emits the backslash literally. The HTML parser then treats that backslash as a literal `\` followed by a real attribute-closing quote, breaking out of the attribute context and allowing an attacker-controlled `<svg/onload=...>` (or any tag) to execute in the context of the debug report. Because the report is generated by design and is commonly treated as a trusted, shareable artifact (support troubleshooting, issue attachments, docs sites), the injection lands in a high-trust product.
SQL output
prqlc's debug-report renderer `write_repr_prql()` in `prqlc/prqlc/src/debug/render_html.rs` correctly HTML-escapes the source *contents* it embeds in `<code id="source-{id}">`, but the *file path* rendered one line earlier by `write_key_values(w, &[("path", &path), ...])` is passed through `escape_html(&format!("{v:?}"))`, i.e. `escape_html` is applied to the `Debug` representation of the `PathBuf` rather than to the raw path string. For a file name containing both a backslash and a double quote, the `Debug` formatter first turns the quote into `\"`, after which `escape_html` emits the backslash literally. The HTML parser then treats that backslash as a literal `\` followed by a real attribute-closing quote, breaking out of the attribute context and allowing an attacker-controlled `<svg/onload=...>` (or any tag) to execute in the context of the debug report. Because the report is generated by design and is commonly treated as a trusted, shareable artifact (support troubleshooting, issue attachments, docs sites), the injection lands in a high-trust product.
Expected SQL output
MVCE confirmation
  • Minimal example
  • New issue
Anything else?

No response

Lingua principale
Rust
Stelle
10.9k
Fork
261
Merge medio
3g 21h
PR unite (30g)
84

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di PRQL/prql

Tutte le issue di PRQL/prql

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.