Docs site: unescaped template/Markdown HTML (stored XSS surface)

未关闭
  • 哪里不对？
#4,972 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
15/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
html, javascript, jquery, markdown
领域
documentation, frontend, security

调研方向

Start with web/static_content/html/tutorial_template.html around line 50, where the YouTube ID is interpolated into jQuery HTML, then check web/static_content/html/include/head.html at lines 13 and 18 for the {{$PAGE_URL}} and {{$PAGE_TITLE}} substitutions. The thread disputes whether the Markdown link path is reachable, and the template renderer lives in a submodule absent from this checkout. Done means the escaping behaviour is confirmed and the fix is agreed with maintainers, so treat this as a security triage task rather than a quick patch.

由索引模型根据 Issue 内容生成。

描述

Summary

The tutorial template interpolates a captured YouTube ID into an HTML string passed to jQuery; head/sidebar/footer templates and the Markdown pipeline emit raw HTML. A malicious page/URL can persist script content into the published site served from kframework.org.

3 finding(s) (2 MEDIUM, 1 LOW) — line-anchor verified at commit 4a46d1231473.

Findings
Severity ID Location Summary
MEDIUM web-misc-001 web/static_content/html/tutorial_template.html:50 DOM XSS sink: unescaped YouTube ID interpolated into jQuery HTML in tutorial template
MEDIUM web-misc-002 web/static_content/html/include/head.html:13 Unescaped template variable {{$PAGE_URL}} injected into rel=canonical href
LOW web-misc-003 web/static_content/html/include/head.html:18 Unescaped template variable {{$PAGE_TITLE}} injected into <title>
Details
web-misc-001 — DOM XSS sink: unescaped YouTube ID interpolated into jQuery HTML in tutorial template (web/static_content/html/tutorial_template.html:50)

Trigger (as reviewed): The tutorial template iterates over every anchor in .markdown-preview and, for any href matching ^https?://youtu.be/(.+?)$, takes the raw capture group youtubeId and interpolates it verbatim into an HTML string that is handed to jQuery $(...) and inserted via replaceWith. The regex anchors only the prefix and end-of-string and does not restrict the character set of the capture group, so a Markdown link target such as https://youtu.be/"> survives the match and lands inside the src="..." attribute of the generated markup.

Impact (as reviewed): The generated markup is parsed by jQuery's HTML parser and inserted into the live page. Because the attacker-controlled value is placed inside a double-quoted attribute with no attribute encoding, an injected quote plus tag/event-handler payload breaks out of the attribute and creates new elements; onerror-style handlers fire on insertion in the real kframework.org origin, giving stored XSS from merged documentation content.

Deep review: reachability=REACHABLE-FROM-UNTRUSTED; exploitability=THEORETICAL; red-team=RED-TEAM-SURVIVED.

Strongest counterargument found during red-teaming: The finding's stated trigger is wrong as written: markdown-it 12.3.2 normalizeLink -> [email protected] encode percent-encodes ", < and > in every Markdown link destination, so [x](https://youtu.be/"><img src=x onerror=alert(1)>) lands in the DOM as %22%3E%3Cimg... and cannot break out of the src attribute. The sink is reachable only because k-web-theme sets html:true with no sanitizer, so the payload must arrive as an entity-encoded raw-HTML anchor (or a markdown-it-attrs {href=...} override), which makes this line a redundant second-order sink rather than the root cause; that root cause (raw HTML passed through unchecked) would allow <img onerror> injection without this template at

web-misc-002 — Unescaped template variable `{{$PAGE_URL}}` injected into `rel=canonical` href (web/static_content/html/include/head.html:13)

Trigger (as reviewed): {{$PAGE_URL}} is substituted by the k-web-theme site generator from page metadata and placed directly inside an attribute value with no HTML-attribute escaping in this template. If the page URL/metadata can be influenced by a contributor and contains a quote or angle bracket, the attribute is broken out of and arbitrary markup is injected into every generated page header.

Impact (as reviewed): Injected markup executes in the kframework.org origin for every visitor of the affected page (stored XSS) and can poison the canonical URL used by crawlers. Confirmation requires reading the k-web-theme renderer, which is a submodule absent from this checkout.

Deep review: reachability=REACHABLE-FROM-UNTRUSTED; exploitability=THEORETICAL; red-team=VERIFIABLE-UNKNOWN.

web-misc-003 — Unescaped template variable `{{$PAGE_TITLE}}` injected into `<title>` (web/static_content/html/include/head.html:18)

Trigger (as reviewed): {{$PAGE_TITLE}} is written inside <title> with no HTML escaping in the template; the value is derived from page metadata during generatePagesFromMarkdownFiles. A title containing </title><script>...</script> breaks out of the title element.

Impact (as reviewed): Persistent script execution on the published docs site in the kframework.org origin, plus a malformed document head for all visitors of the affected page. Escaping responsibility lives in k-web-theme and needs confirmation.

Deep review: reachability=REACHABLE-INTERNAL-ONLY; exploitability=EXPLOITABLE; red-team=VERIFIABLE-UNKNOWN.

Suggested fix

Escape template variables in attribute/text contexts, and sanitize (or explicitly restrict) raw HTML rendered from Markdown before publishing.

Related

Intra-repo sibling references for lines in this bundle: web-misc-003.

From a static audit of this repository at commit 4a46d1231473b599c699160132fd6e76a5c46406 (master). Every location above was verified against the source at that revision; no exploit code was run against this repository or its infrastructure.

主要语言
Python
星标
605
派生
165
30 天内没有已合并 PR

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

runtimeverification/k 的其他 Issue

查看 runtimeverification/k 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。