Fix XSS? #8

WofWca commented 2023年08月29日 14:30:10 +02:00

POC

Create an item with text <img src="doesntexist" onerror="alert('pwned')">

Impact, severity

The impact is not big because all the info is intended to be shared between chat members anyway. Currently none of the existing webxdc apps are resistant to malicious chat members (see "XDC-06" in https://delta.chat/en/2023-05-22-webxdc-security).

Also

The app seems to be keen on using innerHTML:

innerHTML is also used in webxdc.js, which can be found in a lot of webxdc example apps, but I don't know if it's exploitable there.

## POC Create an item with text `<img src="doesntexist" onerror="alert('pwned')">` ## Impact, severity The impact is not big because all the info is intended to be shared between chat members anyway. Currently none of the existing webxdc apps are resistant to malicious chat members (see "XDC-06" in https://delta.chat/en/2023-05-22-webxdc-security). ## Also The app seems to be keen on using `innerHTML`: https://codeberg.org/webxdc/checklist/src/commit/11276463a39558c93c21b3ebb28664e0c24c5c7a/ui-behaviour.js#L179 `innerHTML` is also used in `webxdc.js`, which can be found in a lot of webxdc example apps, but I don't know if it's exploitable there.

r10s commented 2023年08月29日 14:42:34 +02:00

i do not think, things are exploitable as webxdc apps cannot access outside scripts at all.

however, still, we should eg. use innerText after adding the elements (as in calendar) to not guide new js devs to the wrong direction.

but i would do that at the end of the other factorings, might be, things are resolved as some code gets rewritten for other reasons.

i do not think, things are exploitable as webxdc apps cannot access outside scripts at all. however, still, we should eg. use `innerText` after adding the elements (as in calendar) to not guide new js devs to the wrong direction. but i would do that at the end of the other factorings, might be, things are resolved as some code gets rewritten for other reasons.

adbenitez commented 2023年08月29日 21:00:30 +02:00

agree IMHO the main issue is not security risk but wrong display of user input ex if you enter "buy " it is displayed as "buy" only, innerHTML should never be used to insert user input

agree IMHO the main issue is not security risk but wrong display of user input ex if you enter "buy <apples>" it is displayed as "buy" only, innerHTML should never be used to insert user input