#29055: Document that escapejs doesn't make template literals safe
-------------------------------------+-------------------------------------
Reporter: Alvin | Owner: Tim Graham
Lindstam |
Type: | Status: assigned
Cleanup/optimization |
Component: | Version: 2.0
Documentation |
Severity: Normal | Keywords:
Triage Stage: Accepted | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
The `escapejs` template tag is used to make arbitrary input strings safe
to put in a JavaScript string literal. Since
6ae1b04fb584db0fdb22b8e287784c4ed3ac62ac, it escapes the U+0060 (grave
accent) which indicates that it could be used to escape values within
JavaScript template strings (which grave accents are used to declare). The
ticket that it fixes also states that it is intended to be supposed to be
used within template literals (#27900).
`escapejs` escapes the grave accent, so it will not be able to end the
template literal. However, template literals allow embedded expressions
which are executed and whose return value is used in the string. The
syntax to use such expressions is not escaped.
Whenever `escapejs` is used to escape a user provided value to a js
template literal, an attacker could insert text that will be executed as
JavaScript by wrapping it in curly braces with a leading dollar sign, such
as `${alert(String.fromCharCode(88) + String.fromCharCode(83) +
String.fromCharCode(83))}` (which would translate to executing
`alert("XSS")` in the client.
Adding the dollar sign to `_js_escapes` in
https://github.com/django/django/blob/d38a3169a426516623929ff8c2b2c9703d801b75/django/utils/html.py#L55-L68
and replacing it with `\u0024` would fix the problem but break the case of
using template variables to intentionally deliver template literals (non-
user provided). Following a report to the security mailing list, the
consensus is to document that escapejs shouldn't be used to protect
untrusted template literals.
--
Ticket URL: <https://code.djangoproject.com/ticket/29055>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/056.53ea8d4145185346442303db179ecefc%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
