-
Notifications
You must be signed in to change notification settings - Fork 3
Open
Description
When users post comments or writeup text containing special characters like &, the site sometimes displays literal HTML entities (for example &) instead of the original character.
Example: https://crackmes.one/crackme/699da9a00b6d36e727710a49
- Submitted text:
CCCCCChCCCCiCM&CCCCCCCGCCCCCCX#CCKCCC9CCCCCCCCCCCCCCCCCCCCmVC*CC - Displayed on website:
CCCCCChCCCCiCM&CCCCCCCGCCCCCCX#CCKCCC9CCCCCCCCCCCCCCCCCCCCmVC*CC
Issue appears to be double escaping:
- Input is escaped before storing:
app/controllers/comment.py(leave_comment):comment_text = bleach.clean(request.form.get('comment', ''))app/controllers/solution.py(upload_solution_post):info = bleach.clean(request.form.get('info', ''))- Similar pattern also exists for crackme text fields in
app/controllers/crackme.py
- Output is escaped again during rendering:
- Jinja autoescape in templates (e.g.
{{ solution.info }},{{ comment.info }}) app/services/view.pyfilterrender_mentionsexplicitly callsescape(text)before returningMarkup
A raw & can become:
- on write:
& - on render escape:
& - browser then shows literal
&
I would fix is this way... Let me know.
- Stop HTML escaping these plain-text user fields at submit time (comments/writeup info).
- Keep escaping at render time (Jinja autoescape and
render_mentionsescaping logic).
rendering still escapes unsafe HTML correctly
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels