[
https://issues.apache.org/jira/browse/WW-5830?focusedWorklogId=1052604&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1052604
]
ASF GitHub Bot logged work on WW-5830:
--------------------------------------
Author: ASF GitHub Bot
Created on: 05/Nov/26 04:24
Start Date: 05/Nov/26 04:24
Worklog Time Spent: 10m
Work Description: g0w6y commented on PR #2088:
URL: https://github.com/apache/struts/pull/2088#issuecomment-6649629958
Added the JS-string escaping for \`tooltip.ftl\` ($(git -C
~/hunt/pr/7-event-handler-attribute-escaping rev-parse --short HEAD)):
\`${attributes.tooltip?js_string}\` so the value is backslash-escaped before
the existing HTML auto-escaping applies on top, same as you described.
\`EventHandlerEscapeTest\` gets a new case with \`'\` + a script tag in the
tooltip text confirming it can't break out of the JS string; the existing
tooltip test's expectation is updated for the extra backslash now ahead of the
entity encoding. Full core suite: 3632/0 failures.
Issue Time Tracking
-------------------
Worklog Id: (was: 1052604)
Time Spent: 20m (was: 10m)
> FreeMarker UI templates write event-handler attributes (onclick, onsubmit,
> ...) without HTML escaping
> ------------------------------------------------------------------------------------------------------
>
> Key: WW-5830
> URL: https://issues.apache.org/jira/browse/WW-5830
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Affects Versions: 6.12.0, 7.0.0, 7.3.0, 7.4.0
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> The simple, xhtml, css_xhtml and html5 templates write the values of
> event-handler attributes (on*, doubleOn*, doubleAccesskey, the form
> onsubmit/onreset and the xhtml tooltip onmouseover) inside <#outputformat
> 'JavaScript'>${...}</#outputformat>. With FreeMarker 2.3.35 that output
> format does not escape anything and also turns off the surrounding HTML
> auto-escape, so these values are written raw. Every other attribute, for
> example title, is escaped, and the javatemplates engine escapes onclick.
> Reproduction (main, against a running Struts Boot app): <@s.textfield
> name="f" onclick="%\{payload}" title="%\{payload}"/> with the payload x"
> autofocus onfocus="alert(1) renders, in all four themes:
> title="x" autofocus onfocus="alert(1)" onclick="x" autofocus
> onfocus="alert(1)"
> The title value stays inside its attribute; the onclick value closes the
> attribute and adds new ones.
> THREAT_MODEL 8.8 says a value a UI tag renders into an attribute is
> HTML-escaped "under every bundled theme and rendering engine", with
> exceptions only for escape/escapeHtmlBody and URL-valued attributes; section
> 9 says a value the application hands to a framework tag is covered by 8.8.
> Scope: HTML escaping closes the attribute breakout. It does not make request
> data safe inside JavaScript code or strings in a handler (a browser decodes
> ' before the script runs). No default framework path feeding request data
> to these attributes was found; exposure needs an application binding data
> into one, for example onclick="%\{#parameters.x}".
> Affected versions: the wrappers (14 in simple/scripting-events.ftl) are
> present in the 6.12.0, 7.0.0, 7.3.0 and 7.4.0 tags, by source inspection. The
> rendering was only reproduced on main. The wrappers date from the WW-4972
> work (3d20e8095, 35497649b).
> Fix: remove the outputformat wrappers on those attributes (8 templates).
> Behaviour change: handlers containing ' & < > or " change byte-for-byte
> (browser-equivalent); applications that hand-escaped quotes (for example
> ") to work around the raw output would be double-escaped. Suggested
> release note: "Event-handler attributes (onclick, onsubmit, ...) rendered by
> the bundled templates are now HTML-escaped; remove any manual pre-escaping of
> quotes in values passed to them."
> Tests: new EventHandlerEscapeTest (5 of its 6 tests fail without the template
> change); 17 existing fixtures updated (' becomes ').
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
