Merge pull request #1296 from yogeshojha/1185-stored-xss-on-rengine

fix xss on page title fix #1185
yogeshojha · Jul 2, 2024 · 9db6c04 · 9db6c04
2 parents b6acdc3 + a2e1adb
commit 9db6c04
Show file tree

Hide file tree

Showing 2 changed files with 42 additions and 4 deletions.
diff --git a/web/startScan/static/startScan/js/detail_scan.js b/web/startScan/static/startScan/js/detail_scan.js
@@ -146,6 +146,12 @@ function get_endpoints(project, scan_history_id=null, domain_id=null, gf_tags=nu
 				},
 				"targets": 2,
 			},
+			{
+				"render": function ( data, type, row ) {
+					return htmlEncode(data);
+				},
+				"targets": 3,
+			},
 			{
 				"render": function ( data, type, row ) {
 					if (data){
@@ -346,6 +352,15 @@ function get_subdomain_changes(scan_history_id){
 				},
 				"targets": 0
 			},
+			{
+				"render": function ( data, type, row ) {
+					if (data){
+						return htmlEncode(data);
+					}
+					return "";
+				},
+				"targets": 1,
+			},
 			{
 				"render": function ( data, type, row ) {
 					// display badge based on http status
@@ -434,6 +449,15 @@ function get_endpoint_changes(scan_history_id){
 				},
 				"targets": 0
 			},
+			{
+				"render": function ( data, type, row ) {
+					if (data){
+						return htmlEncode(data);
+					}
+					return "";
+				},
+				"targets": 1,
+			},
 			{
 				"render": function ( data, type, row ) {
 					// display badge based on http status
@@ -534,7 +558,7 @@ function get_screenshot(scan_id){
 			else if (data[subdomain]['http_status'] >=300 && data[subdomain]['http_status'] < 400){
 				http_status_badge = 'warning';
 			}
-			page_title = data[subdomain]['page_title'] ? data[subdomain]['page_title'] + '</br>': '' ;
+			page_title = data[subdomain]['page_title'] ? htmlEncode(data[subdomain]['page_title']) + '</br>': '' ;
 			subdomain_link = data[subdomain]['http_url'] ? `<a href="${data[subdomain]['http_url']}" target="_blank">${data[subdomain]['name']}</a>` : `<a href="https://${data[subdomain]['name']}" target="_blank">${data[subdomain]['name']}</a>`
 			http_status = data[subdomain]['http_status'] ? `<span class="m-1 float-end badge  badge-soft-${http_status_badge}">${data[subdomain]['http_status']}</span>` : '';
 			figcaption.innerHTML = data[subdomain]['is_interesting'] ? page_title + subdomain_link + interesting_badge + http_status : page_title + subdomain_link + http_status;

diff --git a/web/static/custom/custom.js b/web/static/custom/custom.js
@@ -611,7 +611,14 @@ function get_interesting_subdomains(project, target_id, scan_history_id) {
 				return `<a href="https://` + data + `" class="text-primary" target="_blank">` + data + `</a>` + tech_badge;
 			},
 			"targets": 0
-		}, {
+		}, 
+		{
+			"render": function(data, type, row) {
+				return htmlEncode(data);
+			},
+			"targets": 1
+		},
+		{
 			"render": function(data, type, row) {
 				// display badge based on http status
 				// green for http status 2XX, orange for 3XX and warning for everything else
@@ -692,7 +699,14 @@ function get_interesting_endpoints(project, target_id, scan_history_id) {
 				return "<a href='" + data + "' target='_blank' class='text-primary'>" + url + "</a>";
 			},
 			"targets": 0
-		}, {
+		}, 
+		{
+			"render": function(data, type, row) {
+				return htmlEncode(data);
+			},
+			"targets": 1
+		},
+		{
 			"render": function(data, type, row) {
 				// display badge based on http status
 				// green for http status 2XX, orange for 3XX and warning for everything else
@@ -1096,7 +1110,7 @@ function render_endpoint_in_xlmodal(endpoint_count, subdomain_name, result) {
 			<tr>
 			<td>${http_url_td}</td>
 			<td>${get_http_status_badge(endpoint['http_status'])}</td>
-			<td>${return_str_if_not_null(endpoint['page_title'])}</td>
+			<td>${return_str_if_not_null(htmlEncode(endpoint['page_title']))}</td>
 			<td>${parse_comma_values_into_span(endpoint['matched_gf_patterns'], "danger", outline=true)}</td>
 			<td>${return_str_if_not_null(endpoint['content_type'])}</td>
 			<td>${return_str_if_not_null(endpoint['content_length'])}</td>