prqlc Debug Report HTML Does Not Escape Source File Name, Enabling Stored XSS via PRQLC_DEBUG_LOG
维护者通常 3 天内回复
还没有人认领这个 Issue。
评估
调研方向
从 prqlc/prqlc/src/debug/render_html.rs 开始，重点查看 write_repr_prql() 和 write_key_values()；issue 指出了路径渲染和转义顺序。检查现有的 HTML 转义测试，并补充文件名包含反斜杠和双引号的测试覆盖。完成标准是调试报告能够渲染该路径，且不会让注入的 HTML 执行。
由索引模型根据 Issue 内容生成。
描述
What happened?
prqlc's debug-report renderer write_repr_prql() in prqlc/prqlc/src/debug/render_html.rs correctly HTML-escapes the source contents it embeds in <code id="source-{id}">, but the file path rendered one line earlier by write_key_values(w, &[("path", &path), ...]) is passed through escape_html(&format!("{v:?}")), i.e. escape_html is applied to the Debug representation of the PathBuf rather than to the raw path string. For a file name containing both a backslash and a double quote, the Debug formatter first turns the quote into \", after which escape_html emits the backslash literally. The HTML parser then treats that backslash as a literal \ followed by a real attribute-closing quote, breaking out of the attribute context and allowing an attacker-controlled <svg/onload=...> (or any tag) to execute in the context of the debug report. Because the report is generated by design and is commonly treated as a trusted, shareable artifact (support troubleshooting, issue attachments, docs sites), the injection lands in a high-trust product.
PRQL input
prqlc's debug-report renderer `write_repr_prql()` in `prqlc/prqlc/src/debug/render_html.rs` correctly HTML-escapes the source *contents* it embeds in `<code id="source-{id}">`, but the *file path* rendered one line earlier by `write_key_values(w, &[("path", &path), ...])` is passed through `escape_html(&format!("{v:?}"))`, i.e. `escape_html` is applied to the `Debug` representation of the `PathBuf` rather than to the raw path string. For a file name containing both a backslash and a double quote, the `Debug` formatter first turns the quote into `\"`, after which `escape_html` emits the backslash literally. The HTML parser then treats that backslash as a literal `\` followed by a real attribute-closing quote, breaking out of the attribute context and allowing an attacker-controlled `<svg/onload=...>` (or any tag) to execute in the context of the debug report. Because the report is generated by design and is commonly treated as a trusted, shareable artifact (support troubleshooting, issue attachments, docs sites), the injection lands in a high-trust product.
SQL output
prqlc's debug-report renderer `write_repr_prql()` in `prqlc/prqlc/src/debug/render_html.rs` correctly HTML-escapes the source *contents* it embeds in `<code id="source-{id}">`, but the *file path* rendered one line earlier by `write_key_values(w, &[("path", &path), ...])` is passed through `escape_html(&format!("{v:?}"))`, i.e. `escape_html` is applied to the `Debug` representation of the `PathBuf` rather than to the raw path string. For a file name containing both a backslash and a double quote, the `Debug` formatter first turns the quote into `\"`, after which `escape_html` emits the backslash literally. The HTML parser then treats that backslash as a literal `\` followed by a real attribute-closing quote, breaking out of the attribute context and allowing an attacker-controlled `<svg/onload=...>` (or any tag) to execute in the context of the debug report. Because the report is generated by design and is commonly treated as a trusted, shareable artifact (support troubleshooting, issue attachments, docs sites), the injection lands in a high-trust product.
Expected SQL output
MVCE confirmation
- Minimal example
- New issue
Anything else?
No response
- 主要语言
- Rust
- 星标
- 10.9k
- 派生
- 261
- 平均合并
- 3 天 21 小时
- 30 天内合并 PR
- 84
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
PRQL/prql 的其他 Issue
-
Underscore does not work as expected可能已有人在做 @prql-bot 于 1 天前认领。 未关闭bug
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 3 天内回复
-
friendliness integrations
难度 2/5 1-3 小时 新手友好度 64/100
PRQL/prql#1636 · 2 条评论 · 2 个 reaction ·
维护者通常 3 天内回复
-
难度 4/5 1-2 天 新手友好度 12/100
维护者通常 3 天内回复
-
review-runs-tracking
难度 3/5 半天 新手友好度 5/100
维护者通常 3 天内回复
-
Formatted SQL adds spaces inside the next string literal after a string ending in a backslash可能重新可做 关联的 PR 已关闭且未合并。 未关闭bug
难度 4/5 1-2 天 新手友好度 38/100
维护者通常 3 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 65/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100
维护者通常 2 天内回复
-
Android visitors are offered the Linux .deb on cap.so's homepage and download page可能已有人在做 @patrickballard 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
CapSoftware/Cap#3677 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
A transform transition under an anonymous block box stops part-way: resolve_transforms skips anonymous boxes可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
DioxusLabs/blitz#1371 ·
维护者通常 1 天内回复