Skip to content

fix: potential XSS vulnerabilities #7923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xhofe merged 6 commits into from
Mar 15, 2025
Merged

fix: potential XSS vulnerabilities #7923

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
217308a
fix: potential XSS vulnerabilities
hshpy Feb 1, 2025
415d6fe
feat: support filter and render for readme.md
hshpy Feb 17, 2025
e07c8aa
Merge branch 'main' into fix3
xhofe Mar 14, 2025
4a130db
chore: set ReadMeAutoRender to true
xhofe Mar 14, 2025
3ad5a60
fix attachFileName undefined
xhofe Mar 14, 2025
5bd8454
Merge branch 'main' into fix3
xhofe Mar 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ require (

require (
github.com/STARRY-S/zip v0.2.1 // indirect
github.com/aymerick/douceur v0.2.0 // indirect
github.com/blevesearch/go-faiss v1.0.20 // indirect
github.com/blevesearch/zapx/v16 v16.1.5 // indirect
github.com/bodgit/plumbing v1.3.0 // indirect
Expand All @@ -97,6 +98,7 @@ require (
github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
github.com/fclairamb/go-log v0.5.0 // indirect
github.com/gorilla/css v1.0.1 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
github.com/hekmon/cunits/v2 v2.1.0 // indirect
Expand All @@ -105,11 +107,13 @@ require (
github.com/klauspost/pgzip v1.2.6 // indirect
github.com/kr/text v0.2.0 // indirect
github.com/matoous/go-nanoid/v2 v2.1.0 // indirect
github.com/microcosm-cc/bluemonday v1.0.27
github.com/nwaples/rardecode/v2 v2.0.0-beta.4.0.20241112120701-034e449c6e78 // indirect
github.com/sorairolake/lzip-go v0.3.5 // indirect
github.com/taruti/bytepool v0.0.0-20160310082835-5e3a9ea56543 // indirect
github.com/therootcompany/xz v1.0.1 // indirect
github.com/ulikunitz/xz v0.5.12 // indirect
github.com/yuin/goldmark v1.7.8
go4.org v0.0.0-20230225012048-214862532bf5 // indirect
)

Expand Down
8 changes: 8 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,8 @@ github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiE
github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
github.com/aymanbagabas/go-udiff v0.2.0 h1:TK0fH4MteXUDspT88n8CKzvK0X9O2xu9yQjWpi6yML8=
github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/pI/QwceO5fgrA=
github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
github.com/benbjohnson/clock v1.3.0 h1:ip6w0uFQkncKQ979AypyG0ER7mqUSBdKLOgAle/AT8A=
github.com/benbjohnson/clock v1.3.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
Expand Down Expand Up @@ -303,6 +305,8 @@ github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+
github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
github.com/googleapis/gax-go/v2 v2.12.2 h1:mhN09QQW1jEWeMF74zGR81R30z4VJzjZsfkUhuHF+DA=
github.com/googleapis/gax-go/v2 v2.12.2/go.mod h1:61M8vcyyXR2kqKFxKrfA22jaA8JGF7Dc8App1U3H6jc=
github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
Expand Down Expand Up @@ -424,6 +428,8 @@ github.com/meilisearch/meilisearch-go v0.27.2 h1:3G21dJ5i208shnLPDsIEZ0L0Geg/5oe
github.com/meilisearch/meilisearch-go v0.27.2/go.mod h1:SxuSqDcPBIykjWz1PX+KzsYzArNLSCadQodWs8extS0=
github.com/mholt/archives v0.1.0 h1:FacgJyrjiuyomTuNA92X5GyRBRZjE43Y/lrzKIlF35Q=
github.com/mholt/archives v0.1.0/go.mod h1:j/Ire/jm42GN7h90F5kzj6hf6ZFzEH66de+hmjEKu+I=
github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
github.com/minio/sio v0.4.0 h1:u4SWVEm5lXSqU42ZWawV0D9I5AZ5YMmo2RXpEQ/kRhc=
Expand Down Expand Up @@ -613,6 +619,8 @@ github.com/yeka/zip v0.0.0-20231116150916-03d6312748a9/go.mod h1:9BnoKCcgJ/+SLhf
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
github.com/yuin/goldmark v1.7.8 h1:iERMLn0/QJeHFhxSt3p6PeN9mGnvIKSpG9YYorDMnic=
github.com/yuin/goldmark v1.7.8/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
github.com/zzzhr1990/go-common-entity v0.0.0-20221216044934-fd1c571e3a22 h1:X+lHsNTlbatQ1cErXIbtyrh+3MTWxqQFS+sBP/wpFXo=
Expand Down
5 changes: 4 additions & 1 deletion internal/bootstrap/data/setting.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
package data

import (
"strconv"

"github.com/alist-org/alist/v3/cmd/flags"
"github.com/alist-org/alist/v3/internal/conf"
"github.com/alist-org/alist/v3/internal/db"
Expand All @@ -11,7 +13,6 @@ import (
"github.com/alist-org/alist/v3/pkg/utils/random"
"github.com/pkg/errors"
"gorm.io/gorm"
"strconv"
)

var initialSettingItems []model.SettingItem
Expand Down Expand Up @@ -141,6 +142,8 @@ func InitialSettings() []model.SettingItem {
{Key: conf.AudioAutoplay, Value: "true", Type: conf.TypeBool, Group: model.PREVIEW},
{Key: conf.VideoAutoplay, Value: "true", Type: conf.TypeBool, Group: model.PREVIEW},
{Key: conf.PreviewArchivesByDefault, Value: "true", Type: conf.TypeBool, Group: model.PREVIEW},
{Key: conf.ReadMeAutoRender, Value: "true", Type: conf.TypeBool, Group: model.PREVIEW},
{Key: conf.FilterReadMeScripts, Value: "true", Type: conf.TypeBool, Group: model.PREVIEW},
// global settings
{Key: conf.HideFiles, Value: "/\\/README.md/i", Type: conf.TypeText, Group: model.GLOBAL},
{Key: "package_download", Value: "true", Type: conf.TypeBool, Group: model.GLOBAL},
Expand Down
3 changes: 2 additions & 1 deletion internal/conf/const.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,8 @@ const (
AudioAutoplay = "audio_autoplay"
VideoAutoplay = "video_autoplay"
PreviewArchivesByDefault = "preview_archives_by_default"

ReadMeAutoRender = "readme_autorender"
FilterReadMeScripts = "filter_readme_scripts"
// global
HideFiles = "hide_files"
CustomizeHead = "customize_head"
Expand Down
64 changes: 64 additions & 0 deletions server/common/proxy.go
View file
Open in desktop
Copy link
Copy Markdown

@ProAlexUSC ProAlexUSC Mar 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#8168 可能是这个 fix 引入的么?

Copy link
Copy Markdown
Contributor

@KirCute KirCute Mar 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

如果把“过滤ReadMe 文件中的脚本”关了问题就解决了，那就说明确实是这个PR带来的问题，但这也不是一个bug，只是你这个使用场景就需要把这个选项关掉

Copy link
Copy Markdown

@ProAlexUSC ProAlexUSC Mar 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

可以针对 webdav 的 get 请求单独处理么？

if utils.Ext(file.GetName()) == "md" && setting.GetBool(conf.FilterReadMeScripts) {

这样有些粗暴了？

Copy link
Copy Markdown

@ProAlexUSC ProAlexUSC Mar 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

如果把“过滤ReadMe 文件中的脚本”关了问题就解决了，那就说明确实是这个PR带来的问题，但这也不是一个bug，只是你这个使用场景就需要把这个选项关掉

建议大佬还是兼容下 WebDAV，否则对于很多依赖 WebDAV 同步 markdown 笔记的用户来说功能都不可用了。

Copy link
Copy Markdown
Contributor

@KirCute KirCute Mar 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

建议大佬还是兼容下 WebDAV，否则对于很多依赖 WebDAV 同步 markdown 笔记的用户来说功能都不可用了。

要不你等这个 PR 的作者给你回复？这个 PR 是解决安全问题的，我也不是很清楚在 webdav 场景下存不存在这种安全问题，我感觉是存在的，如果这样的话从这个 PR 要解决的问题的角度出发没道理单独给 webdav 开绿灯。我意思你就先把“过滤 ReadMe 文件中的脚本”关掉这样用着

Copy link
Copy Markdown
Contributor

@jerry-harm jerry-harm Apr 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

webdev获取的文件又不会渲染，如果我要下载的是md文件那他就不应该变成html文件

Copy link
Copy Markdown
Contributor Author

@hshpy hshpy Apr 2, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

webdev获取的文件又不会渲染，如果我要下载的是md文件那他就不应该变成html文件

这个issue用的软件就是支持webdav协议和实时预览的md编辑器。如果是将webdav挂到本地会不会也有影响？
新版本已经把webdav协议下过滤脚本去掉了，这pr如果影响到使用可以到设置把过滤关掉就跟以前版本一样(关的话最好把自动渲染readme也关掉)

Original file line number Diff line number Diff line change
@@ -1,23 +1,87 @@
package common

import (
"bytes"
"context"
"fmt"
"io"
"net/http"
"net/url"
"os"
"strconv"
"strings"

"github.com/alist-org/alist/v3/internal/conf"
"github.com/alist-org/alist/v3/internal/model"
"github.com/alist-org/alist/v3/internal/net"
"github.com/alist-org/alist/v3/internal/setting"
"github.com/alist-org/alist/v3/internal/stream"
"github.com/alist-org/alist/v3/pkg/http_range"
"github.com/alist-org/alist/v3/pkg/utils"
"github.com/microcosm-cc/bluemonday"
log "github.com/sirupsen/logrus"
"github.com/yuin/goldmark"
)

func processMarkdown(content []byte) ([]byte, error) {
var buf bytes.Buffer
if err := goldmark.New().Convert(content, &buf); err != nil {
return nil, fmt.Errorf("markdown conversion failed: %w", err)
}
return bluemonday.UGCPolicy().SanitizeBytes(buf.Bytes()), nil
}

func Proxy(w http.ResponseWriter, r *http.Request, link *model.Link, file model.Obj) error {

//优先处理md文件
if utils.Ext(file.GetName()) == "md" && setting.GetBool(conf.FilterReadMeScripts) {
var markdownContent []byte
var err error

if link.MFile != nil {
defer link.MFile.Close()
attachHeader(w, file)
markdownContent, err = io.ReadAll(link.MFile)
if err != nil {
return fmt.Errorf("failed to read markdown content: %w", err)
}

} else {
header := net.ProcessHeader(r.Header, link.Header)
res, err := net.RequestHttp(r.Context(), r.Method, header, link.URL)
if err != nil {
return err
}
defer res.Body.Close()
for h, v := range res.Header {
w.Header()[h] = v
}
w.WriteHeader(res.StatusCode)
if r.Method == http.MethodHead {
return nil
}
markdownContent, err = io.ReadAll(res.Body)
if err != nil {
return fmt.Errorf("failed to read markdown content: %w", err)
}

}

safeHTML, err := processMarkdown(markdownContent)
if err != nil {
return err
}

safeHTMLReader := bytes.NewReader(safeHTML)
w.Header().Set("Content-Length", strconv.FormatInt(int64(len(safeHTML)), 10))
w.Header().Set("Content-Type", "text/html; charset=utf-8")
_, err = utils.CopyWithBuffer(w, safeHTMLReader)
if err != nil {
return err
}
return nil
}

if link.MFile != nil {
defer link.MFile.Close()
attachHeader(w, file)
Expand Down
Loading