3 ms·
This API looks like a recipe for XSS vulnerabilities: def render(data): return f"<h1>Last regenerated at: {data['time']}</h1>", {} What if data['time'
by ptx 4y ago
This API looks like a recipe for XSS vulnerabilities:
def render(data):
return f"<h1>Last regenerated at: {data['time']}</h1>", {}
What if data['time'] is '<script>alert("oops!")</script>'?
While JavaScript's template literals [1] would allow this kind of API to work (because the prefix of the template string can be a function that escapes the parameters), Python's f-strings doesn't have equivalent functionality. The tuple returned from the render function should probably include an additional item containing the parameters for the format string (which shouldn't be an f-string).
See also [2].
[1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Template_literals https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
[2] https://en.wikipedia.org/wiki/Uncontrolled_format_string https://en.wikipedia.org/wiki/Uncontrolled_format_string
- seszett 4y agoData isn't user-supplied data, so just don't put Javascript code there yourself and you'll be fine.
- ptx 4y agoThe second example from the documentation [1] disagrees. It displays HTTP header values, which are user supplied, without properly encoding them. Also, it's not just about JavaScript. If values aren't properly encoded as HTML, the app is just plain broken when it tries to display text that contains certain character sequences. For example, the app is not capable of displaying the data value "To create a heading in HTML, use <h1>My heading</h1>". The values need to be separated from the format string and passed through an encoding function such as html.escape [2]. Django learned this lesson 15 years ago in version 1.0 [3]. [1] https://github.com/healeycodes/jar#fresh-pages https://github.com/healeycodes/jar#fresh-pages [2] https://docs.python.org/3/library/html.html#html.escape https://docs.python.org/3/library/html.html#html.escape [3] https://docs.djangoproject.com/en/3.2/releases/1.0-porting-guide/#learn-to-love-autoescaping https://docs.djangoproject.com/en/3.2/releases/1.0-porting-g...
- Jiocus 4y agoSure, you're right about that and I agree with the specifics, but your message doesn't feel relevant to the OP or the discussion. Is it a reasonable expectation that every dev and blog posts must rehash all of OWASP and audit their experimental frameworks (now several years in the making) before publishing?
- ptx 4y agoTemplating is a core concern of a web framework, so a fundamental design flaw in the templating mechanism seems relevant.