GHSA-jq8v-rmf6-65jw: Gogs has Stored XSS in `.ipynb` Preview

Summary Although .ipynb previews are sanitized on the server side via /-/api/sanitize_ipynb, the inserted content is re-rendered on the client side without sanitization using marked() on elements with the .nb-markdown-cell class. During this process, links containing schemes such as javascript: can be regenerated. As a result, when a victim views an attacker-crafted .ipynb file and clicks the link, arbitrary JavaScript is executed in the Gogs origin, leading to a click-based Stored XSS. Details After the rendered output of a .ipynb file is sanitized via /-/api/sanitize_ipynb and inserted into the DOM, only the Markdown cell portions are re-rendered using marked() and overwritten in the DOM. During this process, links with the javascript: scheme can be regenerated. templates/repo/view_file.tmpl:42–71 {{else if .IsIPythonNotebook}} <script> $.getJSON("{{.RawFileLink}}", null, function(notebook_json) { var notebook = nb.parse(notebook_json); var rendered = notebook.render(); $.ajax({ type: "POST", url: '{{AppSubURL}}/-/api/sanitize_ipynb', data: rendered.outerHTML, processData: false, contentType: false, }).done(function(data) { $("#ipython-notebook").append(data); $("#ipython-notebook code").each(function(i, block) { $(block).addClass("py").addClass("python"); hljs.highlightBlock(block); }); // Overwrite image method to append proper prefix to the source URL var renderer = new marked.Renderer(); var context = '{{.RawFileLink}}'; context = context.substring(0, context.lastIndexOf("/")); renderer.image = function (href, title, text) { return <img src="${context}/${href}" }; $("#ipython-notebook .nb-markdown-cell").each(function(i, markdown) { $(markdown).html(marked($(markdown).html(), {renderer: renderer})); }); }); }); </script> While regular HTML pages (including .ipynb preview pages) are served without a Content Security Policy (CSP), CSP headers are applied only to attachment delivery routes. internal/cmd/web.go:323 c.Header().Set("Content-Security-Policy