23fb76f08f
Remove |safe filter from 6 template locations where data from external
search engine APIs was rendered as raw HTML without sanitization. Jinja2
autoescape now properly escapes these fields.
The |safe filter was originally added in commit 213041adc (March 2021)
by copying the pattern from result.title|safe and result.content|safe.
However, title and content are pre-escaped via escape() in webapp.py
lines 704-706 before highlight_content() adds trusted <span> tags for
search term highlighting. The metadata, info.value, link.url_label,
repository, and filename fields never go through any escaping and flow
directly from external API responses to the template.
Affected templates and their untrusted data sources:
- macros.html: result.metadata from DuckDuckGo, Reuters, Presearch,
Podcast Index, Fyyd, bpb, moviepilot, mediawiki, and others
- paper.html: result.metadata from academic search engines
- map.html: info.value and link.url_label from OpenStreetMap
user-contributed extratags
- code.html: result.repository and result.filename from GitHub API
Example exploit: a search engine API returning
metadata='<img src=x onerror=alert(document.cookie)>' would execute
arbitrary JavaScript in every user's browser viewing that result.
39 lines
953 B
HTML
39 lines
953 B
HTML
{% from 'simple/macros.html' import result_header, result_sub_header, result_sub_footer, result_footer with context %}
|
|
|
|
{{ result_header(result, favicons, image_proxify) -}}
|
|
{{- result_sub_header(result) -}}
|
|
|
|
{%- if result.content -%}
|
|
<p class="content">
|
|
{{- result.content|safe -}}
|
|
</p>
|
|
{%- endif -%}
|
|
{%- if result.repository -%}
|
|
<p class="content">{{- '' -}}
|
|
{{ _('Repository') }}: {{- ' ' -}}
|
|
<a href="{{ result.repository }}"{{- ' ' -}}
|
|
{% if results_on_new_tab %}
|
|
target="_blank" {{- ' ' -}}
|
|
rel="noopener noreferrer"
|
|
{%- else -%}
|
|
rel="noreferrer"
|
|
{%- endif -%}
|
|
>
|
|
{{- result.repository -}}
|
|
</a>{{- '' -}}
|
|
</p>
|
|
{%- endif -%}
|
|
|
|
{%- if result.filename %}
|
|
<p class="content">
|
|
{{ _('Filename') }}: {{ result.filename }}
|
|
</p>
|
|
{% endif -%}
|
|
|
|
<div dir="ltr" class="codelines">
|
|
{{- result.HTML()|safe -}}
|
|
</div>
|
|
|
|
{{- result_sub_footer(result) -}}
|
|
{{- result_footer(result) -}}
|