[
https://issues.apache.org/jira/browse/WW-5830?focusedWorklogId=1051641&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1051641
]
ASF GitHub Bot logged work on WW-5830:
--------------------------------------
Author: ASF GitHub Bot
Created on: 31/Oct/26 14:43
Start Date: 31/Oct/26 14:43
Worklog Time Spent: 10m
Work Description: g0w6y opened a new pull request, #2088:
URL: https://github.com/apache/struts/pull/2088
Fixes [WW-5830](https://issues.apache.org/jira/browse/WW-5830)
The `on*` attributes (and `doubleOn*`, `doubleAccesskey`) of the bundled
FreeMarker templates are written inside `<#outputformat
'JavaScript'>${...}</#outputformat>`. These wrappers date from the WW-4972 work
(3d20e8095, 35497649b); doubleselect got its own in WW-5240 (ac168968a), the
html5 theme copied them in WW-5444 (e24d2f2d3), and one more line was added to
optiontransferselect in WW-5772 (a91460ab2). With FreeMarker 2.3.35 the
`JavaScript` output format escapes nothing and also switches off the HTML
auto-escape that covers every other attribute, so these values are written raw.
A handler value such as `x" autofocus onfocus="alert(1)` closes the attribute
and adds new ones, while the same value in `title` is escaped. The
javatemplates engine already escapes these attributes, so the engines also
differ.
THREAT_MODEL §8.8 says a value a UI tag renders into an attribute is
HTML-escaped "under every bundled theme and rendering engine", with only
`escape`/`escapeHtmlBody` and URL-valued attributes excepted; §9 says a value
the application hands to a framework tag is covered by §8.8.
## Change
Drop the `outputformat` wrappers on exactly these attributes:
`simple`/`html5` `scripting-events.ftl`, `simple`/`html5` form
`onsubmit`/`onreset` (`simple/form-common.ftl`, `html5/form.ftl`),
`xhtml/form.ftl` `onreset`, `simple/doubleselect.ftl`,
`simple/optiontransferselect.ftl` (`doubleOn*`, `doubleAccesskey`, the button
`onclick`) and the JS tooltip `onmouseover` in `xhtml/tooltip.ftl`. No
`outputformat` remains under `template/`. `css_xhtml` includes the
`simple`/`xhtml` templates and is covered.
## Compatibility
A handler containing `'`, `&`, `<`, `>` or `"` is now entity-encoded in the
markup (`alert('x')` is written `alert('x')`). Browsers decode
character references in attribute values before the handler runs, so legitimate
handlers behave the same. An application that worked around the raw output by
escaping quotes itself (e.g. `onclick="alert("x")"`) would now be
double-escaped.
This closes the attribute breakout only. It does not make request data safe
inside JavaScript code or strings in a handler (`'` is decoded before the
script runs); that remains the application's job. I found no default framework
path that feeds request data to these attributes; exposure needs an application
that binds data into one, e.g. `onclick="%{#parameters.x}"`.
## Tests
`EventHandlerEscapeTest` renders `x" autofocus onfocus="alert(1)` through
`textfield` (`simple`, `xhtml`, `css_xhtml`, `html5`), `form`, `doubleselect`,
`optiontransferselect` and the JS tooltip, and checks the escaped output, with
`title` as the control and `onclick="doIt();"` still rendered as is. With the
templates reverted 5 of its 6 tests fail (the sixth, the legitimate handler,
passes both ways); with the change all 6 pass.
17 existing expected-output fixtures (34 tests) carried `'` inside an `on*`
value and now carry `'`, as `Radio-6.txt` did in 54d3dd114. I checked every
changed fixture line: the only difference is `'` to `'`.
Full `core` suite on the rebased branch: 3631 run, 0 failures, 0 errors, 2
skipped.
Also checked against a running Struts Boot app rendering `<@s.textfield
onclick="%{payload}" title="%{payload}"/>` with that payload in all four
themes: before, `onclick="x" autofocus onfocus="alert(1)"` (breakout) next to
an escaped `title`; after, `onclick="x" autofocus
onfocus="alert(1)"`, escaped like `title`.
Issue Time Tracking
-------------------
Worklog Id: (was: 1051641)
Remaining Estimate: 0h
Time Spent: 10m
> FreeMarker UI templates write event-handler attributes (onclick, onsubmit,
> ...) without HTML escaping
> ------------------------------------------------------------------------------------------------------
>
> Key: WW-5830
> URL: https://issues.apache.org/jira/browse/WW-5830
> Project: Struts 2
> Issue Type: Bug
> Components: Core
> Affects Versions: 6.12.0, 7.0.0, 7.3.0, 7.4.0
> Reporter: Gouri Sankar A
> Priority: Minor
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The simple, xhtml, css_xhtml and html5 templates write the values of
> event-handler attributes (on*, doubleOn*, doubleAccesskey, the form
> onsubmit/onreset and the xhtml tooltip onmouseover) inside <#outputformat
> 'JavaScript'>${...}</#outputformat>. With FreeMarker 2.3.35 that output
> format does not escape anything and also turns off the surrounding HTML
> auto-escape, so these values are written raw. Every other attribute, for
> example title, is escaped, and the javatemplates engine escapes onclick.
> Reproduction (main, against a running Struts Boot app): <@s.textfield
> name="f" onclick="%\{payload}" title="%\{payload}"/> with the payload x"
> autofocus onfocus="alert(1) renders, in all four themes:
> title="x" autofocus onfocus="alert(1)" onclick="x" autofocus
> onfocus="alert(1)"
> The title value stays inside its attribute; the onclick value closes the
> attribute and adds new ones.
> THREAT_MODEL 8.8 says a value a UI tag renders into an attribute is
> HTML-escaped "under every bundled theme and rendering engine", with
> exceptions only for escape/escapeHtmlBody and URL-valued attributes; section
> 9 says a value the application hands to a framework tag is covered by 8.8.
> Scope: HTML escaping closes the attribute breakout. It does not make request
> data safe inside JavaScript code or strings in a handler (a browser decodes
> ' before the script runs). No default framework path feeding request data
> to these attributes was found; exposure needs an application binding data
> into one, for example onclick="%\{#parameters.x}".
> Affected versions: the wrappers (14 in simple/scripting-events.ftl) are
> present in the 6.12.0, 7.0.0, 7.3.0 and 7.4.0 tags, by source inspection. The
> rendering was only reproduced on main. The wrappers date from the WW-4972
> work (3d20e8095, 35497649b).
> Fix: remove the outputformat wrappers on those attributes (8 templates).
> Behaviour change: handlers containing ' & < > or " change byte-for-byte
> (browser-equivalent); applications that hand-escaped quotes (for example
> ") to work around the raw output would be double-escaped. Suggested
> release note: "Event-handler attributes (onclick, onsubmit, ...) rendered by
> the bundled templates are now HTML-escaped; remove any manual pre-escaping of
> quotes in values passed to them."
> Tests: new EventHandlerEscapeTest (5 of its 6 tests fail without the template
> change); 17 existing fixtures updated (' becomes ').
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
