filter ascii control chars for backspace
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 42/100
Research direction
Start by tracing how Mako filters handle ASCII control characters, especially backspace, and review the referenced MarkupSafe ticket or PR for related behavior. Determine which Mako filters are in scope and verify that a payload like the example no longer renders hidden control characters that survive copying into a terminal.
Written by the indexing model from the issue text.
Description
Migrated issue, originally created by jvanasco (@jvanasco)
I've opened a ticket/PR with Markupsafe for this, but wanted to alert Mako on this too as addressing this behavior may be warranted on other filters.
Most Python libraries for form validation or text sanitizing will let ASCII control characters through. If they make it to Mako, they are rendered in the template as-is, and wind up in web browsers as non-printing characters.
That allows a malicious actor to carefully construct a payload such as this:
import y\bose\bm\bi\bt\be\b
which looks like this on an HTML page:
import yosemite
However all the backspace control characters are in there and will copy/paste into a Python/ruby/etc terminal, where they are interpreted in realtime and become...
import os
If Mako is used as the engine on a coding website or bug reporting system, this introduces a way of tricking users into executing seemingly safe code that is actually malicious.
- Dominant language
- Python
- Stars
- 459
- Forks
- 90
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from sqlalchemy/mako
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
sqlalchemy/mako#432 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
sqlalchemy/mako#417 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
sqlalchemy/mako#392 · 2 comments ·
-
Difficulty 5/5 Over a week Newbie friendliness 15/100
sqlalchemy/mako#382 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 48/100
sqlalchemy/mako#376 · 9 comments ·
Similar issues
-
triage/confirmed
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
agentscope-ai/agentscope#2775 ·
-
comp/desktop P3 type/bug
Difficulty 1/5 Under an hour Newbie friendliness 92/100
NousResearch/hermes-agent#118866 ·
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 90/100
apache/cloudstack#14222 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100