Docs site: unescaped template/Markdown HTML (stored XSS surface)

Đang mở
  • Có gì không ổn?
#4,972 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
15/100
Loại issue
Lỗi
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
html, javascript, jquery, markdown
Lĩnh vực
documentation, frontend, security

Hướng nghiên cứu

Start with web/static_content/html/tutorial_template.html around line 50, where the YouTube ID is interpolated into jQuery HTML, then check web/static_content/html/include/head.html at lines 13 and 18 for the {{$PAGE_URL}} and {{$PAGE_TITLE}} substitutions. The thread disputes whether the Markdown link path is reachable, and the template renderer lives in a submodule absent from this checkout. Done means the escaping behaviour is confirmed and the fix is agreed with maintainers, so treat this as a security triage task rather than a quick patch.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Summary

The tutorial template interpolates a captured YouTube ID into an HTML string passed to jQuery; head/sidebar/footer templates and the Markdown pipeline emit raw HTML. A malicious page/URL can persist script content into the published site served from kframework.org.

3 finding(s) (2 MEDIUM, 1 LOW) — line-anchor verified at commit 4a46d1231473.

Findings
Severity ID Location Summary
MEDIUM web-misc-001 web/static_content/html/tutorial_template.html:50 DOM XSS sink: unescaped YouTube ID interpolated into jQuery HTML in tutorial template
MEDIUM web-misc-002 web/static_content/html/include/head.html:13 Unescaped template variable {{$PAGE_URL}} injected into rel=canonical href
LOW web-misc-003 web/static_content/html/include/head.html:18 Unescaped template variable {{$PAGE_TITLE}} injected into <title>
Details
web-misc-001 — DOM XSS sink: unescaped YouTube ID interpolated into jQuery HTML in tutorial template (web/static_content/html/tutorial_template.html:50)

Trigger (as reviewed): The tutorial template iterates over every anchor in .markdown-preview and, for any href matching ^https?://youtu.be/(.+?)$, takes the raw capture group youtubeId and interpolates it verbatim into an HTML string that is handed to jQuery $(...) and inserted via replaceWith. The regex anchors only the prefix and end-of-string and does not restrict the character set of the capture group, so a Markdown link target such as https://youtu.be/"> survives the match and lands inside the src="..." attribute of the generated markup.

Impact (as reviewed): The generated markup is parsed by jQuery's HTML parser and inserted into the live page. Because the attacker-controlled value is placed inside a double-quoted attribute with no attribute encoding, an injected quote plus tag/event-handler payload breaks out of the attribute and creates new elements; onerror-style handlers fire on insertion in the real kframework.org origin, giving stored XSS from merged documentation content.

Deep review: reachability=REACHABLE-FROM-UNTRUSTED; exploitability=THEORETICAL; red-team=RED-TEAM-SURVIVED.

Strongest counterargument found during red-teaming: The finding's stated trigger is wrong as written: markdown-it 12.3.2 normalizeLink -> [email protected] encode percent-encodes ", < and > in every Markdown link destination, so [x](https://youtu.be/"><img src=x onerror=alert(1)>) lands in the DOM as %22%3E%3Cimg... and cannot break out of the src attribute. The sink is reachable only because k-web-theme sets html:true with no sanitizer, so the payload must arrive as an entity-encoded raw-HTML anchor (or a markdown-it-attrs {href=...} override), which makes this line a redundant second-order sink rather than the root cause; that root cause (raw HTML passed through unchecked) would allow <img onerror> injection without this template at

web-misc-002 — Unescaped template variable `{{$PAGE_URL}}` injected into `rel=canonical` href (web/static_content/html/include/head.html:13)

Trigger (as reviewed): {{$PAGE_URL}} is substituted by the k-web-theme site generator from page metadata and placed directly inside an attribute value with no HTML-attribute escaping in this template. If the page URL/metadata can be influenced by a contributor and contains a quote or angle bracket, the attribute is broken out of and arbitrary markup is injected into every generated page header.

Impact (as reviewed): Injected markup executes in the kframework.org origin for every visitor of the affected page (stored XSS) and can poison the canonical URL used by crawlers. Confirmation requires reading the k-web-theme renderer, which is a submodule absent from this checkout.

Deep review: reachability=REACHABLE-FROM-UNTRUSTED; exploitability=THEORETICAL; red-team=VERIFIABLE-UNKNOWN.

web-misc-003 — Unescaped template variable `{{$PAGE_TITLE}}` injected into `<title>` (web/static_content/html/include/head.html:18)

Trigger (as reviewed): {{$PAGE_TITLE}} is written inside <title> with no HTML escaping in the template; the value is derived from page metadata during generatePagesFromMarkdownFiles. A title containing </title><script>...</script> breaks out of the title element.

Impact (as reviewed): Persistent script execution on the published docs site in the kframework.org origin, plus a malformed document head for all visitors of the affected page. Escaping responsibility lives in k-web-theme and needs confirmation.

Deep review: reachability=REACHABLE-INTERNAL-ONLY; exploitability=EXPLOITABLE; red-team=VERIFIABLE-UNKNOWN.

Suggested fix

Escape template variables in attribute/text contexts, and sanitize (or explicitly restrict) raw HTML rendered from Markdown before publishing.

Related

Intra-repo sibling references for lines in this bundle: web-misc-003.

From a static audit of this repository at commit 4a46d1231473b599c699160132fd6e76a5c46406 (master). Every location above was verified against the source at that revision; no exploit code was run against this repository or its infrastructure.

Ngôn ngữ chính
Python
Star
605
Fork
165
Không có pull request nào được merge trong 30 ngày

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của runtimeverification/k

Tất cả issue của runtimeverification/k

Issue tương tự

Thêm issue về Python

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.