From b5aeef5703dab7da9ebb47cc20e4c8b64f7f5866 Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Thu, 12 Mar 2020 10:25:48 -0700 Subject: [PATCH] Fix possible XSS vector in JS escape helper This commit escapes dollar signs and backticks to prevent JS XSS issues when using the `j` or `javascript_escape` helper CVE-2020-5267 --- actionview/lib/action_view/helpers/javascript_helper.rb | 6 ++++-- actionview/test/template/javascript_helper_test.rb | 8 ++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/actionview/lib/action_view/helpers/javascript_helper.rb b/actionview/lib/action_view/helpers/javascript_helper.rb index acc50f8a62..5d966ba3aa 100644 --- a/actionview/lib/action_view/helpers/javascript_helper.rb +++ b/actionview/lib/action_view/helpers/javascript_helper.rb @@ -12,7 +12,9 @@ module JavaScriptHelper "\n" => '\n', "\r" => '\n', '"' => '\\"', - "'" => "\\'" + "'" => "\\'", + "`" => "\\`", + "$" => "\\$" } JS_ESCAPE_MAP["\342\200\250".dup.force_encoding(Encoding::UTF_8).encode!] = "
" @@ -26,7 +28,7 @@ module JavaScriptHelper # $('some_element').replaceWith('<%= j render 'some/element_template' %>'); def escape_javascript(javascript) if javascript - result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"'])/u) { |match| JS_ESCAPE_MAP[match] } + result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u) { |match| JS_ESCAPE_MAP[match] } javascript.html_safe? ? result.html_safe : result else "" diff --git a/actionview/test/template/javascript_helper_test.rb b/actionview/test/template/javascript_helper_test.rb index a72bc6c2fe..de24245e51 100644 --- a/actionview/test/template/javascript_helper_test.rb +++ b/actionview/test/template/javascript_helper_test.rb @@ -32,6 +32,14 @@ def test_escape_javascript assert_equal %(dont <\\/close> tags), j(%(dont tags)) end + def test_escape_backtick + assert_equal "\\`", escape_javascript("`") + end + + def test_escape_dollar_sign + assert_equal "\\$", escape_javascript("$") + end + def test_escape_javascript_with_safebuffer given = %('quoted' "double-quoted" new-line:\n ) expect = %(\\'quoted\\' \\"double-quoted\\" new-line:\\n <\\/closed>) -- 2.21.0