From 1251d8817264744163fb12a3dba05ce61be5371b Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Thu, 12 Mar 2020 10:25:48 -0700 Subject: [PATCH] Fix possible XSS vector in JS escape helper This commit escapes dollar signs and backticks to prevent JS XSS issues when using the `j` or `javascript_escape` helper CVE-2020-5267 --- actionview/lib/action_view/helpers/javascript_helper.rb | 6 ++++-- actionview/test/template/javascript_helper_test.rb | 8 ++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/actionview/lib/action_view/helpers/javascript_helper.rb b/actionview/lib/action_view/helpers/javascript_helper.rb index b680cb1bd3..b04b1cb43e 100644 --- a/actionview/lib/action_view/helpers/javascript_helper.rb +++ b/actionview/lib/action_view/helpers/javascript_helper.rb @@ -12,7 +12,9 @@ module JavaScriptHelper "\n" => '\n', "\r" => '\n', '"' => '\\"', - "'" => "\\'" + "'" => "\\'", + "`" => "\\`", + "$" => "\\$" } JS_ESCAPE_MAP[(+"\342\200\250").force_encoding(Encoding::UTF_8).encode!] = "
" @@ -29,7 +31,7 @@ def escape_javascript(javascript) if javascript.empty? result = "" else - result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"'])/u) { |match| JS_ESCAPE_MAP[match] } + result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u) { |match| JS_ESCAPE_MAP[match] } end javascript.html_safe? ? result.html_safe : result end diff --git a/actionview/test/template/javascript_helper_test.rb b/actionview/test/template/javascript_helper_test.rb index f974e5ae0c..4b7284d15b 100644 --- a/actionview/test/template/javascript_helper_test.rb +++ b/actionview/test/template/javascript_helper_test.rb @@ -36,6 +36,14 @@ def test_escape_javascript assert_equal %(dont <\\/close> tags), j(%(dont tags)) end + def test_escape_backtick + assert_equal "\\`", escape_javascript("`") + end + + def test_escape_dollar_sign + assert_equal "\\$", escape_javascript("$") + end + def test_escape_javascript_with_safebuffer given = %('quoted' "double-quoted" new-line:\n ) expect = %(\\'quoted\\' \\"double-quoted\\" new-line:\\n <\\/closed>) -- 2.21.0