[xiphos-source] [crosswire/xiphos] d24597: fix: prevent </script> breakout in HtmlOutput anch...

[Devon Kirk]

  Branch: refs/heads/master
  Home:   https://github.com/crosswire/xiphos
  Commit: d2459720d4e1044ff2a9aa9ddd961a72b66f1c30
      https://github.com/crosswire/xiphos/commit/d2459720d4e1044ff2a9aa9ddd961a72b66f1c30
  Author: Devon Kirk <67167176+hyder365 at users.noreply.github.com>
  Date:   2026-06-30 (Tue, 30 Jun 2026)

  Changed paths:
    M src/gtk/utilities.c

  Log Message:
  -----------
  fix: prevent </script> breakout in HtmlOutput anchor JS literal (#1340)

g_strescape() escapes backslash, double-quote, and C0 control bytes but
leaves '<', '>', and '/' untouched, so a sword:// fragment of
"</script><script>PAYLOAD</script>" passes through unchanged when
interpolated into the inline <script> block in HtmlOutput().  WebKit's
HTML parser ends the <script> block at the literal '</script>' and
starts a new <script>PAYLOAD</script> block, which executes arbitrary
JavaScript in the file:// origin that wk_html_set_base_uri() hardcodes.

The fragment can originate from any BibleSync UDP multicast peer on the
LAN (biblesync_glue.cc:179 constructs the sword:// URL from peer-supplied
bible and ref), from argv[1], or from a sword:// href click inside a
malicious SWORD module.

Substitute '</' with '<\/' in the already-escaped anchor (OWASP
recommendation) so the HTML parser can no longer see the end of the
script block.  g_strescape is kept in place to also handle the
backslash-and-quote break-out case from the prior fix (#1337).

Co-authored-by: Devon Kirk <hyder365 at users.noreply.github.com>



To unsubscribe from these emails, change your notification settings at https://github.com/crosswire/xiphos/settings/notifications