GHSA-75mw-h36v-2jv7: Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output Handlers

Summary The HTML and RSS output handlers in dosagelib/events.py write user-controlled content (comic text and page URLs) directly into generated files without proper HTML escaping. When a user scrapes a malicious webcomic and opens the generated HTML/RSS file, attacker-controlled JavaScript can execute in their browser. CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Details Vulnerable Code Locations The vulnerability exists in dosagelib/events.py where untrusted content is written to HTML/RSS output without escaping: 1. RSSEventHandler (lines 116-118) events.py:116-118 if comic.text: description += '<br/>%s' % comic.text # ← Unescaped comic.text description += '<br/><a href="%s">View Comic Online</a>' % pageUrl # ← Unescaped URL 2. HtmlEventHandler (lines 232, 238) events.py:232 self.html.write(u'<li><a href="%s">%s</a>\n' % (pageUrl, pageUrl)) # ← Unescaped URL events.py:238 if text: self.html.write(u'<br/>%s\n' % text) # ← Unescaped text Root Cause - BasicScraper.fetchText() in scraper.py:422 calls html.unescape() on extracted text - The output handlers never call html.escape() before writing to files - No sanitization of URLs or text content occurs anywhere in the output pipeline Data Flow Malicious webcomic page ↓ textSearch XPath extracts content (e.g., img/@title, div text) ↓ BasicScraper.fetchText() calls html.unescape() ↓ comic.text stored without sanitization ↓ HtmlEventHandler/RSSEventHandler writes to file without html.escape() ↓ Generated HTML/RSS contains executable JavaScript PoC I created a proof-of-concept that demonstrates the vulnerability by simulating a malicious comic source. Prerequisites - Docker installed and running PoC Files Create these files in a poc/ directory: 1. poc/Dockerfile FROM python:3.11-slim LABEL description="PoC for dosage Stored XSS vulnerability (CWE-79)" WORKDIR /app COPY . /app Install dependencies RUN pip install --no-cache-dir --quiet imagesize lxm