diff options
| author | Samantaz Fox <coding@samantaz.fr> | 2024-08-24 20:49:17 +0200 |
|---|---|---|
| committer | Samantaz Fox <coding@samantaz.fr> | 2024-08-24 20:50:05 +0200 |
| commit | 2876ee0f9f28060c1cfe9d299a5f8743a73ac054 (patch) | |
| tree | c8e27dfec9089f9e78d822b70fb0a68ace0014ae | |
| parent | 0699e5fc2746e11caf088ce328774b26035cfaa8 (diff) | |
| parent | 0b28054f8ac4066d5f2966a75a92eb935247d737 (diff) | |
| download | invidious-2876ee0f9f28060c1cfe9d299a5f8743a73ac054.tar.gz invidious-2876ee0f9f28060c1cfe9d299a5f8743a73ac054.tar.bz2 invidious-2876ee0f9f28060c1cfe9d299a5f8743a73ac054.zip | |
HTML: Fix XSS vulnerability in description/comments (#4852)
Before this PR, the comment/description content was not HTML escaped when 'parse_description()'
was called with a JSON object lacking the "commandRuns" entry.
Closes issue 4727
| -rw-r--r-- | src/invidious/videos/description.cr | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/src/invidious/videos/description.cr b/src/invidious/videos/description.cr index c7191dec..1371bebb 100644 --- a/src/invidious/videos/description.cr +++ b/src/invidious/videos/description.cr @@ -36,7 +36,13 @@ def parse_description(desc, video_id : String) : String? return "" if content.empty? commands = desc["commandRuns"]?.try &.as_a - return content if commands.nil? + if commands.nil? + # Slightly faster than HTML.escape, as we're only doing one pass on + # the string instead of five for the standard library + return String.build do |str| + copy_string(str, content.each_codepoint, content.size) + end + end # Not everything is stored in UTF-8 on youtube's side. The SMP codepoints # (0x10000 and above) are encoded as UTF-16 surrogate pairs, which are |