Weblate · Report #229735
Self-XSS can be achieved in the editor link using filter bypass
Summary
This issue was reported just because of incomplete #223692 fix, just for fun. The % character could be also used besides %(<keyword>)s with encoded characters like %00, %09 etc in the FORBIDDEN_URL_SCHEMES, which could lead to another filter bypass in some browsers.
The solution was an additional check in the FORBIDDEN_URL_SCHEMES.
How it was found
Description
I saw the fixed issue in the https://hackerone.com/reports/223692 and i think i found another filter bypass. I noticed that we actually can use special keywords like %(branch)s, %(file)s and %(line)s.
So XSS can be achieved in this way:
%(branch)s:alert(1);//https://
if the branch will be named javascript, the payload will be executed upon pressing the source code link of the file inside it.
Steps to reproduce
- Create some branch and name it javascript
- Put some source files.
- Click the link on source file. The
%(branch)swill be replaced by branch name (javascript) and popup will be fired.
Suggested fix
I recommend you to additionally sanitize string by disallowing special symbolst before first : occurence (if exist)