gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve ssrf verification issue and xss in frontend

Browse Source 
Resolves a Cross-Site Scripting (XSS) vulnerability in `frontend/templates/files.html` by applying `escapeHtml` and `sanitizeHighlight` functions when injecting search result attributes directly into the DOM via `innerHTML`.

Also fixes an issue in `app/api/url_upload.py` where providing the `event_hooks` argument twice caused a `SyntaxError` (and potentially bypassed security hooks). Both `validate_redirect` and `verify_redirect` hooks are now safely consolidated into a single list for the `httpx.AsyncClient` initialization.

Also updates tests and .gitignore to prevent CI issues.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
google-labs-jules[bot]
2026-05-17 14:32:51 +00:00
parent 58b14ae769
commit 46ab0ad8e2
5 changed files with 127 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.jules/sentinel.md
+4
View File
@@ -28,3 +28,7 @@
**Vulnerability:** The `/process-url` endpoint used `httpx.AsyncClient(follow_redirects=True)` after validating the initial user-provided URL against SSRF protections. However, it did not validate the target URLs of any subsequent HTTP redirects, allowing an attacker to provide a safe URL that redirects to an internal/private IP, bypassing the security check.
**Learning:** Initial URL validation is insufficient when the HTTP client is configured to follow redirects automatically. The client must be explicitly configured to validate every redirect target.
**Prevention:** When using `httpx.AsyncClient(follow_redirects=True)` for user-provided URLs, always implement a redirect validator hook function (e.g., using `event_hooks={'response': [validate_redirect]}`) that resolves the `Location` header and passes it through the same SSRF validation logic before the redirect is followed.
## 2026-05-03 - XSS in Frontend Templates
**Vulnerability:** In `frontend/templates/files.html`, dynamic variables directly set to `innerHTML` when interpolating results using template strings led to DOM-based XSS when rendering malicious file titles, tags, doc types, filenames, or snippets.
**Learning:** Bypassing `textContent` rendering for UI layout (using JS template strings setting `innerHTML` directly) implicitly trusts back-end structured data. Because backend models (like filenames and OCR tags) may contain unfiltered special characters (like `<` and `>`), this exposes the frontend to stored XSS if not explicitly escaped.
**Prevention:** Apply `escapeHtml` to any strings embedded directly into template strings assigned to `innerHTML`. If the data includes specific formatting to retain (like `<mark>` tags from search tools), provide a robust custom sanitizer like `sanitizeHighlight` that safely encodes everything except the allowed tags.