Inproper data handling leads to crashes and local code execution

[ecneladis]

Multiple outputs are not properly sanitised.

Examples

Filenames in perspectiveList

Filenames are not properly sanitised. Proof of concept:

touch "<img src=x onerror=alert(1)>qwerty"

viewerBrowser, viewerMD, viewerText and editorHTML

It's is possible to render any html code and because of node-webkit architecture we have ability to access the file system or execute arbitrary command using nodejs modules.

<script>
   var exec = require('child_process').exec;
   exec('uname -a',function (error, stdout, stdin) {alert(stdout)});
</script> 

Location name in remove dialog

Same situation as in viewers

Tag names

Special characters lead to unspecified behaviour and crashes.

Solutions

• Node-webkit allows to disable nodejs functionality inside iframes
• Escape and sanitise output - Google Caja seems to be a good choice
• Strict validation of certain inputs, like tag names - validator.js?

[uggrock]

Thank you for your great input! I will try to fix these issues for the next release.

[ecneladis]

Regarding 85c2ceb and 216cfc4, use some existing library to prevent javascript injection. Preventing XSS is not a trivial task, it's very difficult to blacklist all the possibilities.

[uggrock]

I am aware of the fact that XSS fixing is not trivial task. In my commits I was searching for a quick fix of the issues you mentioned. In a future releases of tagspaces I will definitely consider integrating of some library for the XSS prevention.