Skip to content

Fix XSS attack vector #1264

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
josevalim merged 5 commits into from
Mar 14, 2025
Merged

Fix XSS attack vector #1264

josevalim merged 5 commits into from
Mar 14, 2025
+2 −2

Conversation

@i-n-g-m-a-r
Copy link
Contributor

@i-n-g-m-a-r i-n-g-m-a-r commented Mar 14, 2025

@fuelen
Copy link
Contributor

fuelen commented Mar 14, 2025

Could you check these places?

plug/lib/plug/templates/debugger.md.eex

Lines 34 to 38 in 12b1acf

* Query string: <%= @conn.query_string %>
### Headers
<%= for {key, value} <- Enum.sort(@conn.req_headers) do %>
* <%= key %>: <%= value %><% end %>

seems like query_string and headers may be vulnerable as well

@i-n-g-m-a-r
Copy link
Contributor Author

i-n-g-m-a-r commented Mar 14, 2025

@fuelen nice catch, tnx :)

@SteffenDE
Copy link
Contributor

SteffenDE commented Mar 14, 2025

I think the correct approach here is to just escape the whole textarea content:

diff --git a/lib/plug/debugger.ex b/lib/plug/debugger.ex
index 1974db6..4f69d7b 100644
--- a/lib/plug/debugger.ex
+++ b/lib/plug/debugger.ex
@@ -234,7 +234,7 @@ defmodule Plug.Debugger do
         Keyword.merge(assigns,
           conn: conn,
           message: maybe_autolink(message),
-          markdown: markdown,
+          markdown: h(markdown),
           style: style,
           banner: banner,
           actions: actions,
diff --git a/lib/plug/templates/debugger.html.eex b/lib/plug/templates/debugger.html.eex
index fdc8f20..94242a1 100644
--- a/lib/plug/templates/debugger.html.eex
+++ b/lib/plug/templates/debugger.html.eex
@@ -1057,7 +1057,7 @@
         function copyToClipboard () {
           if(navigator.clipboard) {
             // For those working on localhost or HTTPS
-            navigator.clipboard.writeText($copy.innerHTML).then(copiedClipboard).catch(() => {})
+            navigator.clipboard.writeText($copy.textContent).then(copiedClipboard).catch(() => {})
           } else {
             // For those working on HTTP
             $copy.select()

The copy button should use textContent instead of innerHTML.

Not sure if escaping in the markdown template itself is necessary. I guess that depends on who is rendering the markdown, but that's typically not a browser.

SteffenDE
SteffenDE approved these changes Mar 14, 2025
View reviewed changes
Copy link
Contributor

@SteffenDE SteffenDE left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! @josevalim

@josevalim josevalim merged commit 361b7fb into elixir-plug:main Mar 14, 2025
2 checks passed
@josevalim
Copy link
Member

josevalim commented Mar 14, 2025

💚 💙 💜 💛 ❤️

josevalim pushed a commit that referenced this pull request Mar 14, 2025
@i-n-g-m-a-r @josevalim
Fix XSS on debug page (#1264)
dbd349b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@SteffenDE SteffenDE SteffenDE approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@i-n-g-m-a-r @fuelen @SteffenDE @josevalim