Repository navigation
[codeql-go]: Add CWE-79: HTML template escaping passthrough #306
Description
Query
This query is going to be merged into the codeql-go repository through this PR: github/codeql-go#493
CVE ID(s)
No CVEs, yet.
Report
Short summary
This query finds cases where an (html) template is executed using user-provided values that were converted to types that allow completely avoiding the escaping that (normally) values would undergo in the HTML template execution.
Longer summary
Go has a package from the standard library for safely creating and handling HTML templates: html/template
Normally, any value provided to a template from the html/template package would be sensibly escaped to avoid any possible XSS.
Example:
package main
import (
"html/template"
"os"
)
func main() {
tmpl, _ := template.New("test").Parse(`<div>Hello, <b>{{.}}</b></div>`)
{ // This will be correctly escaped:
var escaped = `<img src="example.gif" onload="alert(document.cookie)" width="100" height="132">`
tmpl.Execute(os.Stdout, escaped)
}
}
will render to
<div>Hello, <b><img src="example.gif" onload="alert(document.cookie)" width="100" height="132"></b></div>
However, there are a few special types (HTML, HTMLAttr, JS, JSStr, CSS, Srcset, and URL) that allow values to avoid being escaped.
Example:
package main
import (
"html/template"
"os"
)
func main() {
tmpl, _ := template.New("test").Parse(`<div>Hello, <b>{{.}}</b></div>`)
{
// This will render any provided HTML.
var passthrough = template.HTML(`<img src="example.gif" onload="alert(document.cookie)" width="100" height="132">`)
tmpl.Execute(os.Stdout, passthrough)
}
}
will render to
<div>Hello, <b><img src="example.gif" onload="alert(document.cookie)" width="100" height="132"></b></div>
In essence, converting anything that is user-provided to one of the above types makes an application potentially vulnerable to XSS.
- Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing
No, I'm not planning on discussing this vulnerability submission publicly.
Result(s)
Provide at least one useful result found by your query, on some revision of a real project.
Activity
ghsecuritylab commentedon Mar 19, 2021
Your submission is now in status SecLab review.
For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed
m-y-mo commentedon Mar 22, 2021
@gagliardetto We've reviewed the results from the query. I'd suggest adding a sanitiser that checks when the data becomes numeric type because sometimes the data that goes into a template is a number and that wouldn't cause issues. Thanks.
gagliardetto commentedon Mar 22, 2021
@m-y-mo Thanks for the review. Can you please send me privately a link to an example of such case?
gagliardetto commentedon Mar 22, 2021
You can find me in the securitylab slack
@Slavomir.m-y-mo commentedon Mar 23, 2021
@gagliardetto If you run the query on this project and inspect the paths, you'll see that all the results are tainted by the
userIdwhich is an integer:https://lgtm.com/projects/g/democratic-coin/dcoin-go
Thanks.
gagliardetto commentedon Mar 25, 2021
I added a sanitizer for
NumericType(github/codeql-go@fdfca3b), which should avoid the issue with numbers. As for the few somewhat confusing taint path explanations in the results, I opened github/codeql#9308ghsecuritylab commentedon Apr 1, 2021
Your submission is now in status CodeQL review.
For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed
gagliardetto commentedon Apr 9, 2021
PR merged.
ghsecuritylab commentedon Apr 9, 2021
Your submission is now in status SecLab finalize.
For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed
xcorail commentedon Apr 12, 2021
Created Hackerone report 1161806 for bounty 294551 : [306] [codeql-go]: Add CWE-79: HTML template escaping passthrough
ghsecuritylab commentedon Apr 12, 2021
Your submission is now in status Closed.
For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed
gagliardetto commentedon Apr 12, 2021
🎉 Thank you @xcorail ! 🎉