Mercurial > kallithea

view LICENSE.md @ 6532:33b71a130b16

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
templates: properly escape inline JavaScript values TLDR: Kallithea has issues with escaping values for use in inline JS. Despite judicious poking of the code, no actual security vulnerabilities have been found, just lots of corner-case bugs. This patch fixes those, and hardens the code against actual security issues. The long version: To embed a Python value (typically a 'unicode' plain-text value) in a larger file, it must be escaped in a context specific manner. Example: >>> s = u'<script>alert("It\'s a trap!");</script>' 1) Escaped for insertion into HTML element context >>> print cgi.escape(s) &lt;script&gt;alert("It's a trap!");&lt;/script&gt; 2) Escaped for insertion into HTML element or attribute context >>> print h.escape(s) &lt;script&gt;alert(&#34;It&#39;s a trap!&#34;);&lt;/script&gt; This is the default Mako escaping, as usually used by Kallithea. 3) Encoded as JSON >>> print json.dumps(s) "<script>alert(\"It's a trap!\");</script>" 4) Escaped for insertion into a JavaScript file >>> print '(' + json.dumps(s) + ')' ("<script>alert(\"It's a trap!\");</script>") The parentheses are not actually required for strings, but may be needed to avoid syntax errors if the value is a number or dict (object). 5) Escaped for insertion into a HTML inline <script> element >>> print h.js(s) ("\x3cscript\x3ealert(\"It's a trap!\");\x3c/script\x3e") Here, we need to combine JS and HTML escaping, further complicated by the fact that "<script>" tag contents can either be parsed in XHTML mode (in which case '<', '>' and '&' must additionally be XML escaped) or HTML mode (in which case '</script>' must be escaped, but not using HTML escaping, which is not available in HTML "<script>" tags). Therefore, the XML special characters (which can only occur in string literals) are escaped using JavaScript string literal escape sequences. (This, incidentally, is why modern web security best practices ban all use of inline JavaScript...) Unsurprisingly, Kallithea does not do (5) correctly. In most cases, Kallithea might slap a pair of single quotes around the HTML escaped Python value. A typical benign example: $('#child_link').html('${_('No revisions')}'); This works in English, but if a localized version of the string contains an apostrophe, the result will be broken JavaScript. In the more severe cases, where the text is user controllable, it leaves the door open to injections. In this example, the script inserts the string as HTML, so Mako's implicit HTML escaping makes sense; but in many other cases, HTML escaping is actually an error, because the value is not used by the script in an HTML context. The good news is that the HTML escaping thwarts attempts at XSS, since it's impossible to inject syntactically valid JavaScript of any useful complexity. It does allow JavaScript errors and gibberish to appear on the page, though. In these cases, the escaping has been fixed to use either the new 'h.js' helper, which does JavaScript escaping (but not HTML escaping), OR the new 'h.jshtml' helper (which does both), in those cases where it was unclear if the value might be used (by the script) in an HTML context. Some of these can probably be "relaxed" from h.jshtml to h.js later, but for now, using h.jshtml fixes escaping and doesn't introduce new errors. In a few places, Kallithea JSON encodes values in the controller, then inserts the JSON (without any further escaping) into <script> tags. This is also wrong, and carries actual risk of XSS vulnerabilities. However, in all cases, security vulnerabilities were narrowly avoided due to other filtering in Kallithea. (E.g. many special characters are banned from appearing in usernames.) In these cases, the escaping has been fixed and moved to the template, making it immediately visible that proper escaping has been performed. Mini-FAQ (frequently anticipated questions): Q: Why do everything in one big, hard to review patch? Q: Why add escaping in specific case FOO, it doesn't seem needed? Because the goal here is to have "escape everywhere" as the default policy, rather than identifying individual bugs and fixing them one by one by adding escaping where needed. As such, this patch surely introduces a lot of needless escaping. This is no different from how Mako/Pylons HTML escape everything by default, even when not needed: it's errs on the side of needless work, to prevent erring on the side of skipping required (and security critical) work. As for reviewability, the most important thing to notice is not where escaping has been introduced, but any places where it might have been missed (or where h.jshtml is needed, but h.js is used). Q: The added escaping is kinda verbose/ugly. That is not a question, but yes, I agree. Hopefully it'll encourage us to move away from inline JavaScript altogether. That's a significantly larger job, though; with luck this patch will keep us safe and secure until such a time as we can implement the real fix. Q: Why not use Mako filter syntax ("${val|h.js}")? Because of long-standing Mako bug #140, preventing use of 'h' in filters. Q: Why not work around bug #140, or even use straight "${val|js}"? Because Mako still applies the default h.escape filter before the explicitly specified filters. Q: Where do we go from here? Longer term, we should stop doing variable expansions in script blocks, and instead pass data to JS via e.g. data attributes, or asynchronously using AJAX calls. Once we've done that, we can remove inline JavaScript altogether in favor of separate script files, and set a strict Content Security Policy explicitly blocking inline scripting, and thus also the most common kind of cross-site scripting attack.
author Søren Løvborg <sorenl@unity3d.com>
date Tue, 28 Feb 2017 17:19:00 +0100
parents d36d4d953085
children 6616c6addd1e
line wrap: on
line source

Kallithea License
=================

Kallithea as a whole is copyrighted by various authors and is licensed under
the terms of the GNU General Public License, version 3 (GPLv3), which is a
license published by the Free Software Foundation,
Inc. [A copy of GPLv3](/COPYING) is included herein.

Some individual files have copyright notices and those who offer changes to
those files should update the copyright notices in those specific files if
they so chose.

However, the definitive list of copyright holders for this project is kept in
[the about page template](kallithea/templates/about.html) so that it is
displayed appropriately when Kallithea is installed.  This is the most
important place to update copyright notices.

Third-Party Code Incorporated in Kallithea
==========================================

Various third-party code under GPLv3-compatible licenses is included as part
of Kallithea.


Alembic
-------

Kallithea incorporates an [Alembic](http://alembic.zzzcomputing.com/en/latest/)
"migration environment" in `kallithea/alembic`, portions of which is:

Copyright &copy; 2009-2016 by Michael Bayer.
Alembic is a trademark of Michael Bayer.

and licensed under the MIT-permissive license, which is
[included in this distribution](MIT-Permissive-License.txt).


Bootstrap
---------

Kallithea incorporates the web framework called
[Bootstrap](http://getbootstrap.com/), which is:

Copyright &copy; 2011-2016 Twitter, Inc.
Copyright &copy; 2011-2016 The Bootstrap Authors

and licensed under the MIT-permissive license, which is
[included in this distribution](MIT-Permissive-License.txt),
which can be found together with its Corresponding Source in
https://github.com/twbs/bootstrap at tag v3.3.7 (mirrored at
https://kallithea-scm.org/repos/mirror/bootstrap/ ).



Codemirror
----------

Kallithea incorporates parts of the Javascript system called
[Codemirror](http://codemirror.net/), version 4.7.0, which is primarily:

Copyright &copy; 2013-2014 by Marijn Haverbeke <marijnh@gmail.com>

and licensed under the MIT-permissive license, which is
[included in this distribution](MIT-Permissive-License.txt).

Additional files from upstream Codemirror are copyrighted by various authors
and licensed under other permissive licenses.  The sub-directories under
[.../public/codemirror](kallithea/public/codemirror) include the copyright and
license notice and information as they appeared in Codemirror's upstream
release.



jQuery
------

Kallithea incorporates the Javascript system called
[jQuery](http://jquery.org/), [herein](kallithea/public/js/jquery.min.js),
which can be found together with its Corresponding Source in
https://github.com/jquery/jquery at tag 1.12.3 (mirrored at
https://kallithea-scm.org/repos/mirror/jquery/files/1.12.3/ ).

It is Copyright 2013 jQuery Foundation and other contributors http://jquery.com/ and is under an
[MIT-permissive license](MIT-Permissive-License.txt).



DataTables
----------

Kallithea incorporates the Javascript system called
[DataTables](http://www.datatables.net/)
which can be found together with their Corresponding Source in
https://github.com/DataTables/DataTables at tag 1.10.13 (mirrored at
https://kallithea-scm.org/repos/mirror/DataTables/files/1.10.13/ ).

It is Copyright 2008-2015 SpryMedia Ltd. and is under an
[MIT-permissive license](MIT-Permissive-License.txt).



Mergely
-------

Kallithea incorporates some code from the Javascript system called
[Mergely](http://www.mergely.com/), version 3.3.9.
[Mergely's license](http://www.mergely.com/license.php), a
[copy of which is included in this repository](LICENSE-MERGELY.html),
is (GPL|LGPL|MPL).  Kallithea as GPLv3'd project chooses the GPL arm of that
tri-license.



Select2
-------

Kallithea incorporates parts of the Javascript system called
[Select2](http://ivaynberg.github.io/select2/), which is:

Copyright 2012 Igor Vaynberg (and probably others)

and is licensed [under the following license](https://github.com/ivaynberg/select2/blob/master/LICENSE):

> This software is licensed under the Apache License, Version 2.0 (the
> "Apache License") or the GNU General Public License version 2 (the "GPL
> License"). You may choose either license to govern your use of this
> software only upon the condition that you accept all of the terms of either
> the Apache License or the GPL License.

A [copy of the Apache License 2.0](Apache-License-2.0.txt) is also included
in this distribution.

Kallithea will take the Apache license fork of the dual license, since
Kallithea is GPLv3'd.



Select2-Bootstrap-CSS
---------------------

Kallithea incorporates some CSS from a system called
[Select2-bootstrap-css](https://github.com/t0m/select2-bootstrap-css), which
is:

Copyright &copy; 2013 Tom Terrace (and likely others)

and licensed under the MIT-permissive license, which is
[included in this distribution](MIT-Permissive-License.txt).



History.js
----------

Kallithea incorporates some CSS from a system called History.js, which is

Copyright 2010-2011 Benjamin Arthur Lupton <contact@balupton.com>

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice,
   this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.



YUI
---

Kallithea incorporates parts of the Javascript system called
[YUI 2 — Yahoo! User Interface Library](http://yui.github.io/yui2/docs/yui_2.9.0_full/),
which is made available under the [BSD License](http://yuilibrary.com/license/):

Copyright &copy; 2013 Yahoo! Inc. All rights reserved.

Redistribution and use of this software in source and binary forms, with or
without modification, are permitted provided that the following conditions are
met:

* Redistributions of source code must retain the above copyright notice, this
  list of conditions and the following disclaimer.

* Redistributions in binary form must reproduce the above copyright notice,
  this list of conditions and the following disclaimer in the documentation
  and/or other materials provided with the distribution.

* Neither the name of Yahoo! Inc. nor the names of YUI's contributors may be
  used to endorse or promote products derived from this software without
  specific prior written permission of Yahoo! Inc.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.


Kallithea includes a minified version of YUI 2.9. To build yui.2.9.js:

    git clone https://github.com/yui/builder
    git clone https://github.com/yui/yui2
    cd yui2/
    git checkout hudson-yui2-2800
    ln -sf JumpToPageDropDown.js src/paginator/js/JumpToPageDropdown.js # work around inconsistent casing
    rm -f tmp.js
    for m in yahoo event dom animation datasource autocomplete event-delegate; do
      rm -f build/$m/$m.js
      ( cd src/$m && ant build deploybuild ) && sed -e 's,@VERSION@,2.9.0,g' -e 's,@BUILD@,2800,g' build/$m/$m.js >> tmp.js
    done
    java -jar ../builder/componentbuild/lib/yuicompressor/yuicompressor-2.4.4.jar tmp.js -o yui.2.9.js

In compliance with GPLv3 the Corresponding Source for this Object Code is made
available on
[https://kallithea-scm.org/repos/mirror](https://kallithea-scm.org/repos/mirror).



Flot
----

Kallithea incorporates some CSS from a system called
[Flot](http://code.google.com/p/flot/), which is:

Copyright 2006 Google Inc.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.

A [copy of the Apache License 2.0](Apache-License-2.0.txt) is also included
in this distribution.



Icon fonts
----------

Kallithea incorporates subsets of both
[Font Awesome](http://fontawesome.io) and
[GitHub Octicons](https://octicons.github.com) for icons. Font Awesome is:

Copyright (c) 2012, Dave Gandy

Octicons is:

Copyright (c) 2012-2014 GitHub

These two sets are distributed under [SIL OFL 1.1](http://scripts.sil.org/OFL)
and have been combined into one font called "kallithea."


EOF