Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Text pasted from clipboard is evaluated as HTML #1073

Closed
naoey opened this issue Jun 10, 2019 · 7 comments
Closed

Text pasted from clipboard is evaluated as HTML #1073

naoey opened this issue Jun 10, 2019 · 7 comments
Assignees
@nikku
Labels
bug Something isn't working
Milestone
M29

Comments

@naoey
Copy link

naoey commented Jun 10, 2019

Describe the Bug

Pasting HTML text anywhere that allows text input in the modeler evaluates the HTML as is, creating a potential XSS vulnerability.

Steps to Reproduce

Steps to reproduce the behavior:

  1. Add any element onto the canvas
  2. Begin editing the name of the element
  3. Copy and paste the text <video src=1 onerror=alert('hueh')>

Observe displayed alert. The issue is reproducible on the demo site.

image

Expected Behavior

HTML clipboard content should not be evaluated.

Environment

Please complete the following information:

  • Browser: Firefox 67, Chrome 74
  • OS: macOS 10.14.5
  • Library version: ^2.5.2, ^3.4.1
@nikku nikku added the bug Something isn't working label Jun 10, 2019
@nikku nikku added this to the M29 milestone Jun 10, 2019
@nikku nikku added the ready Ready to be worked on label Jun 10, 2019
@nikku
Copy link
Member

nikku commented Jun 11, 2019 •
edited
Loading

The problem is that we use a contenteditable container for text editing and that we do not properly escape the pasted text.

@naoey
Copy link
Author

naoey commented Jun 11, 2019 •
edited
Loading

Is there a priority or target that you could say this issue would be resolved by? Mainly to evaluate our project's timelines for getting a fix in.

@nikku
Copy link
Member

nikku commented Jun 12, 2019

We are currently looking into the issue and building a fix.

@nikku nikku mentioned this issue Jun 12, 2019
Closed
@nikku nikku self-assigned this Jun 12, 2019
nikku added a commit to bpmn-io/diagram-js-direct-editing that referenced this issue Jun 12, 2019
@nikku
fix(TextBox): prevent insertion of HTML
3054839 
This prevents the evaluation of arbitrary JavaScript when pasting HTML
code into the edit box such as

```javascript
<video src=1 onerror=alert('hueh')>
```

Related to bpmn-io/bpmn-js#1073
@nikku
Copy link
Member

nikku commented Jun 12, 2019

Upstream fix, currently in review: bpmn-io/diagram-js-direct-editing#13.

merge-me bot pushed a commit to bpmn-io/diagram-js-direct-editing that referenced this issue Jun 12, 2019
@nikku @merge-me
fix(TextBox): prevent insertion of HTML
122cb92 
This prevents the evaluation of arbitrary JavaScript when pasting HTML
code into the edit box such as

```javascript
<video src=1 onerror=alert('hueh')>
```

Related to bpmn-io/bpmn-js#1073
@nikku nikku added in progress Currently worked on and removed ready Ready to be worked on labels Jun 12, 2019 — with bpmn-io-tasks
@nikku nikku closed this as completed in 1535282 Jun 13, 2019
@bpmn-io-tasks bpmn-io-tasks bot removed the in progress Currently worked on label Jun 13, 2019
@nikku
Copy link
Member

nikku commented Jun 13, 2019 •
edited
Loading

Backported to:

nikku added a commit that referenced this issue Jun 13, 2019
@nikku
fix(modeling): prevent insertion of pasted HTML
8ef1e86 
Closes #1073
nikku added a commit that referenced this issue Jun 13, 2019
@nikku
fix(modeling): prevent insertion of pasted HTML
7e193b7 
Closes #1073
@nikku
Copy link
Member

nikku commented Jun 13, 2019

Released fix as v2.5.3, v3.4.2.

@nikku
Copy link
Member

nikku commented Jun 13, 2019

See security notice for further details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@nikku nikku

Labels
bug Something isn't working
Projects
None yet
Milestone
M29
Development

No branches or pull requests
2 participants
@nikku @naoey