Script injection

[Jun Omae]

Any scripts can be injected via id argument:

{{{#!Mermaid id="''><script>alert(42)</script>"
....
}}}

mermaidmacro/1.0/tracmermaid/mermaid.py

@@ -33 +33 @@
         if args == None or 'id' not in args:
             id_attr = ''
         else:
-            id_attr = 'id=%s' % args['id']
+            id_attr = 'id=%s' % escape(args['id'])
         url_escaped_content = urllib2.quote(content)
         div = """<div class="mermaid"
                       %s

[Jun Omae]

The same issue can be occurred via wiki page named with "><script>alert(42)</script>.

mermaidmacro/1.0/tracmermaid/mermaid.py

@@ -43 +43 @@
                       data-mermaidsource="%s">%s</div>"""
         return div % (
                 id_attr,
-                formatter.context.resource.realm,
-                formatter.context.resource.id,
-                formatter.context.resource.version or '',
+                escape(formatter.context.resource.realm),
+                escape(formatter.context.resource.id),
+                escape(formatter.context.resource.version or ''),
                 escape(url_escaped_content),
                 escape(content))
 

[Christian Boos]

Oh, good catch, didn't see that one...

Just in case you're also testing my changes, I even have one more pending improvement, the support for TracLinks in flow charts.

I'll first version the changes locally so that we can have separated patches per ticket.

[Christian Boos]

incremental patch, on top of 004 in #13042

[Christian Boos]

For good measure. Now you have all my changes. Would be nice if tkob had a github repo for this plugin, but it seems not.

[Christian Boos]

take 2, add missing "" after id=

[Christian Boos]

By the way, it seems possible to insert <script> tags via the "normal" mermaid editor. Try the following:

sq["node <b>text</b><script>alert('bad!')</script>"] --> ci((Circle shape))

in ​http://knsv.github.io/mermaid/live_editor/.

However, via the MermaidMacro it seems OK, the alert doesn't show up, though the text is still bold. I haven't understood yet the difference between the two situations, i.e. the generated markup seems to be the same. Maybe you have a clue and could tell if there's a possible injection risk via this method?

[tkob-trac]

In 16179:

Add escape to avoid script injection, fixes #13040