simonw/datasette-css-properties

Is ?_raw=column an XSS security hole?

Open

#1 opened on Jan 7, 2021

View on GitHub
 (8 comments) (0 reactions) (0 assignees)Python (1 fork)github user discovery
help wanted

Repository metrics

Stars
 (15 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

The ?_raw=column mechanism makes me a little nervous. It feels like it could be used for XSS, since it allows attackers to inject exact values into a page that is served by Datasette - e.g. https://latest-with-plugins.datasette.io/fixtures.css?sql=select+%27%3Cscript%3Ealert(%22evil%2C+perhaps%22)%3C%2Fscript%3E%27+as+evil%3B&_raw=evil

:root {
  --evil: <script>alert("evil, perhaps")</script>;
}

But that page is served with the text/css content-type - it's not HTML.

Could a browser be tricked into rendering it as HTML, in which case it would open up a XSS hole in the hosting Datasette instance?

Contributor guide

Research direction
Investigate whether the raw=column parameter can be exploited for XSS by forcing the browser to interpret the response as HTML instead of CSS. Check if Datasette sets the Content Type header properly and if there are known techniques to bypass content type checks.
Tech stack
python
Domain
backendsecurity
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitPython
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
50