Possible XSS in issue dependancies #2672

New Issue

2025-11-02T04:44:03-06:00

GiteaMirror commented

2025-11-02 04:44:03 -06:00

Originally created by @zarunet on GitHub (Dec 19, 2018).

Gitea version (or commit ref): release 1.6.1
Git version: 2.11.0
Operating system: Debian 9.6
Database (use [x]):
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes, at https://try.gitea.io/Simia_/test-repository/issues/1
- No
- Not relevant
Log gist:

Description

When adding an issue with an HTML tag in the title, said HTML doesn't seem to be escaped.

In this example, the <select> tag in the title is displayed as an actual <select>

Originally created by @zarunet on GitHub (Dec 19, 2018).  - Gitea version (or commit ref): release 1.6.1 - Git version: 2.11.0 - Operating system: Debian 9.6 - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes, at https://try.gitea.io/Simia_/test-repository/issues/1 - [ ] No - [ ] Not relevant - Log gist: ## Description When adding an issue with an HTML tag in the title, said HTML doesn't seem to be escaped. In this example, the `<select>` tag in the title is displayed as an actual `<select>` ![2018-12-19_14-43-35](https://user-images.githubusercontent.com/43345608/50224323-eea43b00-039d-11e9-959a-ba638e25c357.png)

GiteaMirror added the topic/security label 2025-11-02 04:44:03 -06:00

GiteaMirror closed this issue

2025-11-02 04:44:03 -06:00

GiteaMirror commented

2025-11-02 04:44:04 -06:00

@zeripath commented on GitHub (Dec 19, 2018):

I can confirm this.

@zeripath commented on GitHub (Dec 19, 2018): I can confirm this.

GiteaMirror commented

2025-11-02 04:44:04 -06:00

@zeripath commented on GitHub (Dec 19, 2018):

@simia-zaru Can you please email security@gitea.io

@zeripath commented on GitHub (Dec 19, 2018): @simia-zaru Can you please email security@gitea.io

GiteaMirror commented

2025-11-02 04:44:04 -06:00

@zarunet commented on GitHub (Dec 19, 2018):

@simia-zaru Can you please email security@gitea.io

Done. Thanks for the tip

@zarunet commented on GitHub (Dec 19, 2018): > > > @simia-zaru Can you please email [security@gitea.io](mailto:security@gitea.io) Done. Thanks for the tip

GiteaMirror commented

2025-11-02 04:44:04 -06:00

@zeripath commented on GitHub (Dec 19, 2018):

Repository descriptions are also affected although less destructively as it appears that script elements are stripped out.

@zeripath commented on GitHub (Dec 19, 2018): Repository descriptions are also affected although less destructively as it appears that script elements are stripped out.

GiteaMirror commented

2025-11-02 04:44:05 -06:00

@zeripath commented on GitHub (Dec 19, 2018):

Similarly for milestone descriptions.

@zeripath commented on GitHub (Dec 19, 2018): Similarly for milestone descriptions.

GiteaMirror commented

2025-11-02 04:44:05 -06:00

@zeripath commented on GitHub (Dec 19, 2018):

Actually there's a flash on the application of a milestone title to an issue whereby it will execute an embedded script.

@zeripath commented on GitHub (Dec 19, 2018): Actually there's a flash on the application of a milestone title to an issue whereby it will execute an embedded script.

GiteaMirror commented

2025-11-02 04:44:05 -06:00

@techknowlogick commented on GitHub (Dec 21, 2018):

@simia-zaru thanks for the report. You will be thanked in our release blog post.

@techknowlogick commented on GitHub (Dec 21, 2018): @simia-zaru thanks for the report. You will be thanked in our release blog post.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#2672