Infrastructure/astro
0
Fork 0
mirror of https://github.com/withastro/astro.git synced 2025-03-24 23:21:57 -05:00
Code Issues Activity

Fix an XSS in Server Islands. (#11508)

Browse source 
* Fix an XSS in Server Islands.

Discussed with @FredKSchott that this is OK to disclose since Server Islands are still experimental.

It's generally not safe to use `JSON.stringify` to interpolate potentially attacker controlled data into `<script>` tags as JSON doesn't escape `<>"'` and so one can use it to break out of the script tag and e.g. make a new one with controlled content.

See https://pragmaticwebsecurity.com/articles/spasecurity/json-stringify-xss

* Format

* Create smart-snakes-promise.md

* Switch to manual encoding

---------

Co-authored-by: Matt Kane <m@mk.gg>
This commit is contained in:
Malte Ubl 2024-07-19 07:02:14 -07:00 • committed by GitHub
parent 026e8baf33
commit ca335e1dc0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 18 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
.changeset/smart-snakes-promise.md Normal file
View file

@ -0,0 +1,5 @@
---
"astro": patch
---
Escapes HTML in serialized props

17
packages/astro/src/runtime/server/render/server-islands.ts
View file

@ -14,6 +14,15 @@ export function containsServerDirective(props: Record<string | number, any>) {
return 'server:component-directive' in props;
}
function safeJsonStringify(obj: any) {
return JSON.stringify(obj)
.replace(/\u2028/g, '\\u2028')
.replace(/\u2029/g, '\\u2029')
.replace(/</g, '\\u003c')
.replace(/>/g, '\\u003e')
.replace(/\//g, '\\u002f');
}
export function renderServerIsland(
result: SSRResult,
_displayName: string,
@ -53,13 +62,13 @@ export function renderServerIsland(
const hostId = crypto.randomUUID();
destination.write(`<script async type="module" data-island-id="${hostId}">
let componentId = ${JSON.stringify(componentId)};
let componentExport = ${JSON.stringify(componentExport)};
let componentId = ${safeJsonStringify(componentId)};
let componentExport = ${safeJsonStringify(componentExport)};
let script = document.querySelector('script[data-island-id="${hostId}"]');
let data = {
componentExport,
props: ${JSON.stringify(props)},
slots: ${JSON.stringify(renderedSlots)},
props: ${safeJsonStringify(props)},
slots: ${safeJsonStringify(renderedSlots)},
};
let response = await fetch('/_server-islands/${componentId}', {