github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-03-13 02:57:44 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

Search query gets rendered as HTML #1515

New Issue
Closed
opened 2025-11-02 04:03:35 -06:00 by GiteaMirror · 3 comments
GiteaMirror commented 2025-11-02 04:03:35 -06:00
Owner
Copy Link

Originally created by @jonasfranz on GitHub (Feb 10, 2018).

  • Gitea version (or commit ref): 1.4.0+rc1
  • Operating system: Ubuntu Server 16.04
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • MSSQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:
    • Yes (provide example URL)
    • No, because repo indexer is disabled
    • Not relevant

Description

When I enter a HTML tag into the repository search, the query gets rendered as HTML. But it is sort of escaped because only h1, b, i etc. are rendered but without parameters like onload.

Screenshots

Search-Query: <i>

screenshot-2018-2-10 frontend 1

Search-Query: <h1>

screenshot-2018-2-10 frontend

Search-Query: <b>Hello</b><h1>World</h1>

screenshot-2018-2-10 frontend 2

Originally created by @jonasfranz on GitHub (Feb 10, 2018). - Gitea version (or commit ref): 1.4.0+rc1 - Operating system: Ubuntu Server 16.04 - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [ ] Yes (provide example URL) - [x] No, because repo indexer is disabled - [ ] Not relevant ## Description When I enter a HTML tag into the repository search, the query gets rendered as HTML. But it is sort of escaped because only h1, b, i etc. are rendered but without parameters like onload. ## Screenshots Search-Query: `<i>` ![screenshot-2018-2-10 frontend 1](https://user-images.githubusercontent.com/5757182/36063557-cd78eaa8-0e7e-11e8-880a-4c023ee8e277.png) Search-Query: `<h1>` ![screenshot-2018-2-10 frontend](https://user-images.githubusercontent.com/5757182/36063558-d06a7ff6-0e7e-11e8-9865-72a3650176af.png) Search-Query: `<b>Hello</b><h1>World</h1>` ![screenshot-2018-2-10 frontend 2](https://user-images.githubusercontent.com/5757182/36063586-1b794572-0e7f-11e8-924d-63e162bf7d59.png)
GiteaMirror added the topic/security label 2025-11-02 04:03:35 -06:00
GiteaMirror commented 2025-11-02 04:03:36 -06:00
Author
Owner
Copy Link

@jonasfranz commented on GitHub (Feb 10, 2018):

This might be also security relevant because attackers could send links containing a message for example to send credentials to the attacker.

@jonasfranz commented on GitHub (Feb 10, 2018): This might be also security relevant because attackers could send links containing a message for example to send credentials to the attacker.
GiteaMirror commented 2025-11-02 04:03:36 -06:00
Author
Owner
Copy Link

@ethantkoenig commented on GitHub (Feb 12, 2018):

FYI, while this is certainly a bug (good catch @JonasFranzDEV), I don't believe XSS is a concern because the search query was previously piped through Str2Html (which sanitizes unsafe HTML)

@ethantkoenig commented on GitHub (Feb 12, 2018): FYI, while this is certainly a bug (good catch @JonasFranzDEV), I don't believe XSS is a concern because the search query was previously piped through `Str2Html` (which sanitizes unsafe HTML)
GiteaMirror commented 2025-11-02 04:03:36 -06:00
Author
Owner
Copy Link

@jonasfranz commented on GitHub (Feb 12, 2018):

@ethantkoenig You're right. It is not a real XSS but it could be used to show the user a big text for example saying to send there password to an email.

@jonasfranz commented on GitHub (Feb 12, 2018): @ethantkoenig You're right. It is not a real XSS but it could be used to show the user a big text for example saying to send there password to an email.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label topic/security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#1515
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?