fix: Complete multi-character sanitization #416

ACN-kck · 2022-06-23T16:02:16Z

Go to know by CodeQL in another project, that there is a missing multi-character sanitization.

https://github.com/whelk-io/maven-settings-xml-action/pull/144/files#diff-3d2b59189eeedc2d428ddd632e97658fe310f587f7cb63b01f9b98ffc11c0197R909

karfau · 2022-06-24T07:41:26Z

Thank you for the report and for the PR.
I was able to verify the bug:
when parsing the following XML:
<xml><child></child <injected></xml>
xmldom produces the dom equivalent to
<xml><child /><injected /></xml>
xmldom also reports at least one error in this situation
[xmldom error] end tag name: child maybe not complete, so not trusting any xml that reports errors (by adding a custom error handler, see https://github.com/xmldom/xmldom#api-reference ) is the best workaround currently.

Sadly the PR doesn't fix that (potential security) issue, which is not documented publicly.

ACN-kck · 2022-06-24T19:56:36Z

Thank you for the report and for the PR. I was able to verify the bug: when parsing the following XML: <xml><child></child <injected></xml> xmldom produces the dom equivalent to <xml><child /><injected /></xml> xmldom also reports at least one error in this situation [xmldom error] end tag name: child maybe not complete, so not trusting any xml that reports errors (by adding a custom error handler, see https://github.com/xmldom/xmldom#api-reference ) is the best workaround currently.

Sadly the PR doesn't fix that (potential security) issue, which is not documented publicly.

I reviewed my solution again which indeed does not fix the issue. I checked again how this could be resolved by creating one additional test based on your message.

With your given example:
<xml><child></child <injected></xml> should be parsed to
<xml><child/></xml>, correct?

ACN-kck · 2022-06-24T20:06:48Z

lib/sax.js

 	        		errorHandler.error("end tag name: "+tagName+' is not complete:'+config.tagName);
 	        		end = tagStart+1+tagName.length;
 	        	}else if(tagName.match(/\s</)){
-	        		tagName = tagName.replace(/[\s<].*/,'');
+	        		tagName = tagName.replace(/[\s<].*/g,'');


By calculating the length first, the injection could be prevented.
Snapshot test 'unclosed inner' in simple.test.js will start failing, but while looking into it I'm struggling to understand why the test should work without errors. My expectation would be that it fails with an error.

Suggested change

tagName = tagName.replace(/[\s<].*/g,'');

end = tagStart + 2 + tagName.length;

tagName = tagName.replace(/[\s<].*/g,'');

And we need to shift the index +1 to catch the closing '>'

karfau · 2022-06-24T20:14:24Z

Yes, I agree that this support for automatically closing unclosed tags is the culprit.
So the fix will be a breaking change in the semver sense.

ACN-kck · 2022-06-24T20:48:26Z

Yes, I agree that this support for automatically closing unclosed tags is the culprit. So the fix will be a breaking change in the semver sense.

I'm not having the full view on the lib in regards to this breaking change.
Is there something I should have a closed look?

karfau · 2022-10-08T23:16:14Z

Sorry for not replying for such a long time.
I will get back to looking at this PR starting from November.

mgerlach · 2022-10-10T21:07:23Z

Would be good to have this released soon for whelk-io/maven-settings-xml-action#144

karfau · 2022-10-11T00:30:04Z

@mgerlach @ACN-kck what is the reason for not using the latest version in the linked PR?

The reason why I'm asking this is that any fx we can come up with, would also be a breaking change, so you will have to update to at least 0.9.* version.
~~(And currently the PR doesn't fix the issue, so it would be on me picking up the work.)~~ Sorry, for some reason I didn't notice the commits that have been added after the conversation.

If the effort is not to high it would be awesome to have that CodeQL check as part of the xmldom pipeline.
Are you able to help me setting this up?
This could be done in a separate PR, in which case it would contribute to hacktoberfest, in case that is relevant for anybody.
And I'm going to look into the option of including it into the 0.9.0 release (I recently published a pre-release 0.9.0-beta.1 in preparation of that).

karfau · 2022-10-11T05:21:20Z

I have tried to understand the current state of the PR, but I'm not able to relate the code suggestion in the comment to the code that was already commited.

I'm also not able to push updates to your branch, I guess you didn't check the box "allow edits by maintainers"?

So it looks like I have to replicate you changes in a local branch to better understand them.

mgerlach · 2022-10-11T06:05:52Z

Hi @karfau I only jumped onto this because GitHub Actions is complaining about https://github.com/whelk-io/maven-settings-xml-action still using Node.js 12. whelk-io/maven-settings-xml-action#144 would fix that (among other things). I don't know why the PR has xmldom-0.7.0 rather than 0.8.3... @ACN-kck or @zteater, can you please help @karfau?

Previously it was tested as a feature, that tags after incomplete closing tags would be part of the dom. The code responsible for this triggered a CodeQL error suspecting that it could lead to injection of a `script` tag. When parsing HTML there no longer an error being reported to align the behavior with the one in the browser. BREAKING CHANGE: If your code relied on not well formed XML to be parsed and include subsequent tags, this will no longer work. #416

Previously it was tested as a feature, that tags after incomplete closing tags would be part of the dom. The code responsible for this triggered a CodeQL error suspecting that it could lead to injection of a `script` tag. BREAKING CHANGE: It no longer reports an error when parsing HTML containing incomplete closing tags, to align the behavior with the one in the browser. BREAKING CHANGE: If your code relied on not well formed XML to be parsed and include subsequent tags, this will no longer work. #416

Related PR #416 Docs: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning

karfau · 2022-10-18T05:00:01Z

@ACN-kck @mgerlach I fixed this in a more robust way in #445, which will be part of the 0.9.0 release.
I was also able to configure CodeQL checks to the repo as part of #444

Thank you for your contributions.

fix(sax): Complete multi-character sanitization

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.

GPG key ID: 4AEE18F83AFDEB23
Expired

Verified
Learn about vigilant mode

17bea88

ACN-kck mentioned this pull request Jun 23, 2022

Upgrade dependencies to latest versions, clear vulnerabilities whelk-io/maven-settings-xml-action#144

Merged

ACN-kck changed the title ~~Complete multi-character sanitization~~ fix: Complete multi-character sanitization Jun 23, 2022

ACN-kck commented Jun 24, 2022

View reviewed changes

ACN-kck added 2 commits June 24, 2022 22:41

fix(sax): Add multiline sanitization test

36ff448

fix(sax): skip tag definition within tag definition

41b1e1b

karfau self-assigned this Oct 8, 2022

karfau added needs investigation xml:not well-formed breaking change labels Oct 8, 2022

karfau added this to the next breaking/minor release milestone Oct 8, 2022

karfau mentioned this pull request Oct 18, 2022

fix: Stop adding tags after incomplete closing tag #445

Merged

karfau mentioned this pull request Oct 18, 2022

ci: Add CodeQL scan #444

Merged

karfau added a commit that referenced this pull request Oct 18, 2022

ci: Add CodeQL scan (#444)

ef4ff68

Related PR #416 Docs: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning

karfau closed this Oct 18, 2022

karfau modified the milestones: next breaking/minor release, 0.9.0 Oct 18, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: Complete multi-character sanitization #416

fix: Complete multi-character sanitization #416

ACN-kck commented Jun 23, 2022

karfau commented Jun 24, 2022 •

edited

Loading

ACN-kck commented Jun 24, 2022

ACN-kck Jun 24, 2022

ACN-kck Jun 24, 2022

karfau commented Jun 24, 2022

ACN-kck commented Jun 24, 2022

karfau commented Oct 8, 2022

mgerlach commented Oct 10, 2022

karfau commented Oct 11, 2022 •

edited

Loading

karfau commented Oct 11, 2022

mgerlach commented Oct 11, 2022 •

edited

Loading

karfau commented Oct 18, 2022

	tagName = tagName.replace(/[\s<].*/g,'');
	end = tagStart + 2 + tagName.length;
	tagName = tagName.replace(/[\s<].*/g,'');

fix: Complete multi-character sanitization #416

fix: Complete multi-character sanitization #416

Conversation

ACN-kck commented Jun 23, 2022

karfau commented Jun 24, 2022 • edited Loading

ACN-kck commented Jun 24, 2022

ACN-kck Jun 24, 2022

Choose a reason for hiding this comment

ACN-kck Jun 24, 2022

Choose a reason for hiding this comment

karfau commented Jun 24, 2022

ACN-kck commented Jun 24, 2022

karfau commented Oct 8, 2022

mgerlach commented Oct 10, 2022

karfau commented Oct 11, 2022 • edited Loading

karfau commented Oct 11, 2022

mgerlach commented Oct 11, 2022 • edited Loading

karfau commented Oct 18, 2022

karfau commented Jun 24, 2022 •

edited

Loading

karfau commented Oct 11, 2022 •

edited

Loading

mgerlach commented Oct 11, 2022 •

edited

Loading