[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: [oss-security] [CVE-2020-5267] Possible XSS vulnerability in ActionView
From: Aaron Patterson <tenderlove () ruby-lang ! org>
Date: 2020-03-19 16:58:40
Message-ID: 20200319165840.GA16288 () tc-lan-adapter ! local
[Download RAW message or body]
[Attachment #2 (multipart/mixed)]
There is a possible XSS vulnerability in ActionView's JavaScript literal
escape helpers. Views that use the `j` or `escape_javascript` methods
may be susceptible to XSS attacks.
Versions Affected: All.
Not affected: None.
Fixed Versions: 6.0.2.2, 5.2.4.2
### Impact
There is a possible XSS vulnerability in the `j` and `escape_javascript`
methods in ActionView. These methods are used for escaping JavaScript string
literals. Impacted code will look something like this:
```erb
<script>let a = `<%= j unknown_input %>`</script>
```
or
```erb
<script>let a = `<%= escape_javascript unknown_input %>`</script>
```
### Releases
The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.
### Workarounds
For those that can't upgrade, the following monkey patch may be used:
```ruby
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
{
"`" => "\\`",
"$" => "\\$"
}
)
module ActionView::Helpers::JavaScriptHelper
alias :old_ej :escape_javascript
alias :old_j :j
def escape_javascript(javascript)
javascript = javascript.to_s
if javascript.empty?
result = ""
else
result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
end
javascript.html_safe? ? result.html_safe : result
end
alias :j :escape_javascript
end
```
### Patches
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.
* 5-2-js-helper-xss.patch - Patch for 5.2 series
* 6-0-js-helper-xss.patch - Patch for 6.0 series
Please note that only the 5.2 and 6.0 series are supported at present. Users
of earlier unsupported releases are advised to upgrade as soon as possible as we
cannot guarantee the continued availability of security fixes for unsupported
releases.
### Credits
Thanks to Jesse Campos from Chef Secure
--
Aaron Patterson
http://tenderlovemaking.com/
["5-2-js-helper-xss.patch" (text/plain)]
From b5aeef5703dab7da9ebb47cc20e4c8b64f7f5866 Mon Sep 17 00:00:00 2001
From: Aaron Patterson <aaron.patterson@gmail.com>
Date: Thu, 12 Mar 2020 10:25:48 -0700
Subject: [PATCH] Fix possible XSS vector in JS escape helper
This commit escapes dollar signs and backticks to prevent JS XSS issues
when using the `j` or `javascript_escape` helper
CVE-2020-5267
---
actionview/lib/action_view/helpers/javascript_helper.rb | 6 ++++--
actionview/test/template/javascript_helper_test.rb | 8 ++++++++
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/actionview/lib/action_view/helpers/javascript_helper.rb \
b/actionview/lib/action_view/helpers/javascript_helper.rb index acc50f8a62..5d966ba3aa 100644
--- a/actionview/lib/action_view/helpers/javascript_helper.rb
+++ b/actionview/lib/action_view/helpers/javascript_helper.rb
@@ -12,7 +12,9 @@ module JavaScriptHelper
"\n" => '\n',
"\r" => '\n',
'"' => '\\"',
- "'" => "\\'"
+ "'" => "\\'",
+ "`" => "\\`",
+ "$" => "\\$"
}
JS_ESCAPE_MAP["\342\200\250".dup.force_encoding(Encoding::UTF_8).encode!] = "
"
@@ -26,7 +28,7 @@ module JavaScriptHelper
# $('some_element').replaceWith('<%= j render 'some/element_template' %>');
def escape_javascript(javascript)
if javascript
- result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"'])/u) { \
|match| JS_ESCAPE_MAP[match] } + result = \
javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u) { |match| \
JS_ESCAPE_MAP[match] } javascript.html_safe? ? result.html_safe : result
else
""
diff --git a/actionview/test/template/javascript_helper_test.rb \
b/actionview/test/template/javascript_helper_test.rb index a72bc6c2fe..de24245e51 100644
--- a/actionview/test/template/javascript_helper_test.rb
+++ b/actionview/test/template/javascript_helper_test.rb
@@ -32,6 +32,14 @@ def test_escape_javascript
assert_equal %(dont <\\/close> tags), j(%(dont </close> tags))
end
+ def test_escape_backtick
+ assert_equal "\\`", escape_javascript("`")
+ end
+
+ def test_escape_dollar_sign
+ assert_equal "\\$", escape_javascript("$")
+ end
+
def test_escape_javascript_with_safebuffer
given = %('quoted' "double-quoted" new-line:\n </closed>)
expect = %(\\'quoted\\' \\"double-quoted\\" new-line:\\n <\\/closed>)
--
2.21.0
["6-0-js-helper-xss.patch" (text/plain)]
From 1251d8817264744163fb12a3dba05ce61be5371b Mon Sep 17 00:00:00 2001
From: Aaron Patterson <aaron.patterson@gmail.com>
Date: Thu, 12 Mar 2020 10:25:48 -0700
Subject: [PATCH] Fix possible XSS vector in JS escape helper
This commit escapes dollar signs and backticks to prevent JS XSS issues
when using the `j` or `javascript_escape` helper
CVE-2020-5267
---
actionview/lib/action_view/helpers/javascript_helper.rb | 6 ++++--
actionview/test/template/javascript_helper_test.rb | 8 ++++++++
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/actionview/lib/action_view/helpers/javascript_helper.rb \
b/actionview/lib/action_view/helpers/javascript_helper.rb index b680cb1bd3..b04b1cb43e 100644
--- a/actionview/lib/action_view/helpers/javascript_helper.rb
+++ b/actionview/lib/action_view/helpers/javascript_helper.rb
@@ -12,7 +12,9 @@ module JavaScriptHelper
"\n" => '\n',
"\r" => '\n',
'"' => '\\"',
- "'" => "\\'"
+ "'" => "\\'",
+ "`" => "\\`",
+ "$" => "\\$"
}
JS_ESCAPE_MAP[(+"\342\200\250").force_encoding(Encoding::UTF_8).encode!] = "
"
@@ -29,7 +31,7 @@ def escape_javascript(javascript)
if javascript.empty?
result = ""
else
- result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"'])/u) { \
|match| JS_ESCAPE_MAP[match] } + result = \
javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u) { |match| \
JS_ESCAPE_MAP[match] } end
javascript.html_safe? ? result.html_safe : result
end
diff --git a/actionview/test/template/javascript_helper_test.rb \
b/actionview/test/template/javascript_helper_test.rb index f974e5ae0c..4b7284d15b 100644
--- a/actionview/test/template/javascript_helper_test.rb
+++ b/actionview/test/template/javascript_helper_test.rb
@@ -36,6 +36,14 @@ def test_escape_javascript
assert_equal %(dont <\\/close> tags), j(%(dont </close> tags))
end
+ def test_escape_backtick
+ assert_equal "\\`", escape_javascript("`")
+ end
+
+ def test_escape_dollar_sign
+ assert_equal "\\$", escape_javascript("$")
+ end
+
def test_escape_javascript_with_safebuffer
given = %('quoted' "double-quoted" new-line:\n </closed>)
expect = %(\\'quoted\\' \\"double-quoted\\" new-line:\\n <\\/closed>)
--
2.21.0
["signature.asc" (application/pgp-signature)]
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic