iv-org
/
invidious
mirror of https://gitea.invidious.io/iv-org/invidious
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

HTML: Fix XSS vulnerability in description/comments (#4852) 

Before this PR, the comment/description content was not HTML escaped when 'parse_description()'
was called with a JSON object lacking the "commandRuns" entry.

Closes issue 4727
This commit is contained in:
Samantaz Fox 2024-08-24 20:49:17 +02:00
parent 0699e5fc27 0b28054f8a
commit 2876ee0f9f
No known key found for this signature in database
GPG Key ID: F42821059186176E
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/invidious/videos/description.cr
View File

@ -36,7 +36,13 @@ def parse_description(desc, video_id : String) : String?
return "" if content.empty? return "" if content.empty?
commands = desc["commandRuns"]?.try &.as_a commands = desc["commandRuns"]?.try &.as_a
return content if commands.nil? if commands.nil?
# Slightly faster than HTML.escape, as we're only doing one pass on
# the string instead of five for the standard library
return String.build do |str|
copy_string(str, content.each_codepoint, content.size)
end
end
# Not everything is stored in UTF-8 on youtube's side. The SMP codepoints # Not everything is stored in UTF-8 on youtube's side. The SMP codepoints
# (0x10000 and above) are encoded as UTF-16 surrogate pairs, which are # (0x10000 and above) are encoded as UTF-16 surrogate pairs, which are