Skip to content

Commit 9641ae0

Browse files
C85297C85297
authored
Fix XSS in Show Base64 offsets (#2346)
1 parent 864afa8 commit 9641ae0

2 files changed

Lines changed: 39 additions & 28 deletions

File tree

‎src/core/operations/ShowBase64Offsets.mjs‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -77,84 +77,84 @@ class ShowBase64Offsets extends Operation {
7777
staticSection = offset0.slice(0, -3);
7878
offset0 = "<span data-toggle='tooltip' data-placement='top' title='" +
7979
Utils.escapeHtml(fromBase64(staticSection, alphabet).slice(0, -2)) + "'>" +
80-
staticSection + "</span>" +
81-
"<span class='hl5'>" + offset0.substr(offset0.length - 3, 1) + "</span>" +
82-
"<span class='hl3'>" + offset0.substr(offset0.length - 2) + "</span>";
80+
Utils.escapeHtml(staticSection) + "</span>" +
81+
"<span class='hl5'>" + Utils.escapeHtml(offset0.substr(offset0.length - 3, 1)) + "</span>" +
82+
"<span class='hl3'>" + Utils.escapeHtml(offset0.substr(offset0.length - 2)) + "</span>";
8383
} else if (len0 % 4 === 3) {
8484
staticSection = offset0.slice(0, -2);
8585
offset0 = "<span data-toggle='tooltip' data-placement='top' title='" +
8686
Utils.escapeHtml(fromBase64(staticSection, alphabet).slice(0, -1)) + "'>" +
87-
staticSection + "</span>" +
88-
"<span class='hl5'>" + offset0.substr(offset0.length - 2, 1) + "</span>" +
89-
"<span class='hl3'>" + offset0.substr(offset0.length - 1) + "</span>";
87+
Utils.escapeHtml(staticSection) + "</span>" +
88+
"<span class='hl5'>" + Utils.escapeHtml(offset0.substr(offset0.length - 2, 1)) + "</span>" +
89+
"<span class='hl3'>" + Utils.escapeHtml(offset0.substr(offset0.length - 1)) + "</span>";
9090
} else {
9191
staticSection = offset0;
9292
offset0 = "<span data-toggle='tooltip' data-placement='top' title='" +
9393
Utils.escapeHtml(fromBase64(staticSection, alphabet)) + "'>" +
94-
staticSection + "</span>";
94+
Utils.escapeHtml(staticSection) + "</span>";
9595
}
9696

9797
if (!showVariable) {
98-
offset0 = staticSection;
98+
offset0 = Utils.escapeHtml(staticSection);
9999
}
100100

101101

102102
// Highlight offset 1
103-
padding = "<span class='hl3'>" + offset1.substr(0, 1) + "</span>" +
104-
"<span class='hl5'>" + offset1.substr(1, 1) + "</span>";
103+
padding = "<span class='hl3'>" + Utils.escapeHtml(offset1.substr(0, 1)) + "</span>" +
104+
"<span class='hl5'>" + Utils.escapeHtml(offset1.substr(1, 1)) + "</span>";
105105
offset1 = offset1.substr(2);
106106
if (len1 % 4 === 2) {
107107
staticSection = offset1.slice(0, -3);
108108
offset1 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
109109
Utils.escapeHtml(fromBase64("AA" + staticSection, alphabet).slice(1, -2)) + "'>" +
110-
staticSection + "</span>" +
111-
"<span class='hl5'>" + offset1.substr(offset1.length - 3, 1) + "</span>" +
112-
"<span class='hl3'>" + offset1.substr(offset1.length - 2) + "</span>";
110+
Utils.escapeHtml(staticSection) + "</span>" +
111+
"<span class='hl5'>" + Utils.escapeHtml(offset1.substr(offset1.length - 3, 1)) + "</span>" +
112+
"<span class='hl3'>" + Utils.escapeHtml(offset1.substr(offset1.length - 2)) + "</span>";
113113
} else if (len1 % 4 === 3) {
114114
staticSection = offset1.slice(0, -2);
115115
offset1 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
116116
Utils.escapeHtml(fromBase64("AA" + staticSection, alphabet).slice(1, -1)) + "'>" +
117-
staticSection + "</span>" +
118-
"<span class='hl5'>" + offset1.substr(offset1.length - 2, 1) + "</span>" +
119-
"<span class='hl3'>" + offset1.substr(offset1.length - 1) + "</span>";
117+
Utils.escapeHtml(staticSection) + "</span>" +
118+
"<span class='hl5'>" + Utils.escapeHtml(offset1.substr(offset1.length - 2, 1)) + "</span>" +
119+
"<span class='hl3'>" + Utils.escapeHtml(offset1.substr(offset1.length - 1)) + "</span>";
120120
} else {
121121
staticSection = offset1;
122122
offset1 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
123123
Utils.escapeHtml(fromBase64("AA" + staticSection, alphabet).slice(1)) + "'>" +
124-
staticSection + "</span>";
124+
Utils.escapeHtml(staticSection) + "</span>";
125125
}
126126

127127
if (!showVariable) {
128-
offset1 = staticSection;
128+
offset1 = Utils.escapeHtml(staticSection);
129129
}
130130

131131
// Highlight offset 2
132-
padding = "<span class='hl3'>" + offset2.substr(0, 2) + "</span>" +
133-
"<span class='hl5'>" + offset2.substr(2, 1) + "</span>";
132+
padding = "<span class='hl3'>" + Utils.escapeHtml(offset2.substr(0, 2)) + "</span>" +
133+
"<span class='hl5'>" + Utils.escapeHtml(offset2.substr(2, 1)) + "</span>";
134134
offset2 = offset2.substr(3);
135135
if (len2 % 4 === 2) {
136136
staticSection = offset2.slice(0, -3);
137137
offset2 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
138138
Utils.escapeHtml(fromBase64("AAA" + staticSection, alphabet).slice(2, -2)) + "'>" +
139-
staticSection + "</span>" +
140-
"<span class='hl5'>" + offset2.substr(offset2.length - 3, 1) + "</span>" +
141-
"<span class='hl3'>" + offset2.substr(offset2.length - 2) + "</span>";
139+
Utils.escapeHtml(staticSection) + "</span>" +
140+
"<span class='hl5'>" + Utils.escapeHtml(offset2.substr(offset2.length - 3, 1)) + "</span>" +
141+
"<span class='hl3'>" + Utils.escapeHtml(offset2.substr(offset2.length - 2)) + "</span>";
142142
} else if (len2 % 4 === 3) {
143143
staticSection = offset2.slice(0, -2);
144144
offset2 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
145145
Utils.escapeHtml(fromBase64("AAA" + staticSection, alphabet).slice(2, -2)) + "'>" +
146-
staticSection + "</span>" +
147-
"<span class='hl5'>" + offset2.substr(offset2.length - 2, 1) + "</span>" +
148-
"<span class='hl3'>" + offset2.substr(offset2.length - 1) + "</span>";
146+
Utils.escapeHtml(staticSection) + "</span>" +
147+
"<span class='hl5'>" + Utils.escapeHtml(offset2.substr(offset2.length - 2, 1)) + "</span>" +
148+
"<span class='hl3'>" + Utils.escapeHtml(offset2.substr(offset2.length - 1)) + "</span>";
149149
} else {
150150
staticSection = offset2;
151151
offset2 = padding + "<span data-toggle='tooltip' data-placement='top' title='" +
152152
Utils.escapeHtml(fromBase64("AAA" + staticSection, alphabet).slice(2)) + "'>" +
153-
staticSection + "</span>";
153+
Utils.escapeHtml(staticSection) + "</span>";
154154
}
155155

156156
if (!showVariable) {
157-
offset2 = staticSection;
157+
offset2 = Utils.escapeHtml(staticSection);
158158
}
159159

160160
return (showVariable ? "Characters highlighted in <span class='hl5'>green</span> could change if the input is surrounded by more data." +

‎tests/operations/tests/Base64.mjs‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,4 +116,15 @@ TestRegister.addTests([
116116
},
117117
],
118118
},
119+
{
120+
name: "Show Base64 offsets: escapes static output",
121+
input: "\x00\x10\x83\x10\x51\x87",
122+
expectedOutput: "&lt;script&gt;\n&lt;AQmsBRk66\n&lt;ia1AEIM6",
123+
recipeConfig: [
124+
{
125+
op: "Show Base64 offsets",
126+
args: ["<script>ale(1)/.ABCDEFGHIJKLMNOPQRSTUVWXYZbdfghjkmnoquvwxyz023456", false, "Raw"],
127+
},
128+
],
129+
},
119130
]);

0 commit comments

Comments
 (0)