mirror of
https://codeberg.org/forgejo/forgejo
synced 2024-09-12 01:41:32 +02:00
[SECURITY] Fix XSS in wiki last commit information
- On the wiki and revisions page, information is shown about the last commit that modified that wiki page. This includes the time it was last edited and by whom. That whole string is not being sanitized (passed trough `Safe` in the templates), because the last edited bit is formatted as an HTML element and thus shouldn't be sanitized. The problem with this is that now `.Author.Name` is not being sanitized. - This can be exploited, the names of authors and commiters on a Git commit is user controlled, they can be any value and thus also include HTML. It's not easy to actually exploit this, as you cannot use the official git binary to do use, as they actually strip `<` and `>` from user names (trivia: this behaviour was introduced in the initial commit of Git). In the integration testing, go-git actually has to generate this commit as they don't have such restrictions. - Pass `.Author.Name` trough `Escape` in order to be sanitized.
This commit is contained in:
parent
33af169223
commit
d24c37e132
|
@ -10,7 +10,7 @@
|
|||
{{$title}}
|
||||
<div class="ui sub header gt-word-break">
|
||||
{{$timeSince := TimeSince .Author.When ctx.Locale}}
|
||||
{{ctx.Locale.Tr "repo.wiki.last_commit_info" .Author.Name $timeSince | Safe}}
|
||||
{{ctx.Locale.Tr "repo.wiki.last_commit_info" (.Author.Name | Escape) $timeSince | Safe}}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
|
|
@ -40,7 +40,7 @@
|
|||
{{$title}}
|
||||
<div class="ui sub header">
|
||||
{{$timeSince := TimeSince .Author.When ctx.Locale}}
|
||||
{{ctx.Locale.Tr "repo.wiki.last_commit_info" .Author.Name $timeSince | Safe}}
|
||||
{{ctx.Locale.Tr "repo.wiki.last_commit_info" (.Author.Name | Escape) $timeSince | Safe}}
|
||||
</div>
|
||||
</div>
|
||||
<div class="eight wide right aligned column">
|
||||
|
|
Loading…
Reference in a new issue