srcdoc in iframe not escaped correctly
pgasior opened this issue · comments
Describe the bug
Content in srcdoc attribute of iframe needs additional escaping of & character. HTML spec.
For example < needs to be escaped to &lt;
This shows when trying to display HTML escaped content inside <pre>
Report has iframe with content unescaped. When I open the attachment HTML file directly, it is escaped.
To Reproduce
Steps to reproduce the behavior:
- Add HTML attachment with
<pre><h1>should be escapedd</h1></pre>
Expected behavior
Escaped HTML tags remain escaped inside iframe in report
Attachments
JSFiddle with current behavior link
JSFiddle with expected behavior link
Thanks for reporting this!
I think that this also applies to escaping " in Embedding.decodeData(string). It shouldn't be converted to ' but to ".
Citing the spec And remember to escape ampersands before quotation marks, to ensure quotation marks become " and not &quot;.
So if I understand this correctly fix would be in Embedding.java
decodedData.replaceAll("&", "&").replaceAll("\"", """);
Will be fixed in 2.6.0 (release planned for today).
👋 @laxersaz do you see this as a potential security issue?
if it is, we (at Snyk would like to add it to our vulnerability database.
I don't quite follow your question. I am not an expert in software security.