Gouri Sankar A created WW-5830:
----------------------------------
Summary: FreeMarker UI templates write event-handler attributes
(onclick, onsubmit, ...) without HTML escaping
Key: WW-5830
URL: https://issues.apache.org/jira/browse/WW-5830
Project: Struts 2
Issue Type: Bug
Components: Core
Affects Versions: 7.4.0, 7.3.0, 7.0.0, 6.12.0
Reporter: Gouri Sankar A
The simple, xhtml, css_xhtml and html5 templates write the values of
event-handler attributes (on*, doubleOn*, doubleAccesskey, the form
onsubmit/onreset and the xhtml tooltip onmouseover) inside <#outputformat
'JavaScript'>${...}</#outputformat>. With FreeMarker 2.3.35 that output format
does not escape anything and also turns off the surrounding HTML auto-escape,
so these values are written raw. Every other attribute, for example title, is
escaped, and the javatemplates engine escapes onclick.
Reproduction (main, against a running Struts Boot app): <@s.textfield name="f"
onclick="%\{payload}" title="%\{payload}"/> with the payload x" autofocus
onfocus="alert(1) renders, in all four themes:
title="x" autofocus onfocus="alert(1)" onclick="x" autofocus
onfocus="alert(1)"
The title value stays inside its attribute; the onclick value closes the
attribute and adds new ones.
THREAT_MODEL 8.8 says a value a UI tag renders into an attribute is
HTML-escaped "under every bundled theme and rendering engine", with exceptions
only for escape/escapeHtmlBody and URL-valued attributes; section 9 says a
value the application hands to a framework tag is covered by 8.8.
Scope: HTML escaping closes the attribute breakout. It does not make request
data safe inside JavaScript code or strings in a handler (a browser decodes
' before the script runs). No default framework path feeding request data
to these attributes was found; exposure needs an application binding data into
one, for example onclick="%\{#parameters.x}".
Affected versions: the wrappers (14 in simple/scripting-events.ftl) are present
in the 6.12.0, 7.0.0, 7.3.0 and 7.4.0 tags, by source inspection. The rendering
was only reproduced on main. The wrappers date from the WW-4972 work
(3d20e8095, 35497649b).
Fix: remove the outputformat wrappers on those attributes (8 templates).
Behaviour change: handlers containing ' & < > or " change byte-for-byte
(browser-equivalent); applications that hand-escaped quotes (for example
") to work around the raw output would be double-escaped. Suggested
release note: "Event-handler attributes (onclick, onsubmit, ...) rendered by
the bundled templates are now HTML-escaped; remove any manual pre-escaping of
quotes in values passed to them."
Tests: new EventHandlerEscapeTest (5 of its 6 tests fail without the template
change); 17 existing fixtures updated (' becomes ').
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
