From d655030770081e2dfe46f90e27620472a502289d Mon Sep 17 00:00:00 2001 From: David Lord Date: Thu, 2 May 2024 09:14:00 -0700 Subject: [PATCH] disallow invalid characters in keys to xmlattr filter --- CHANGES.rst | 6 ++++++ src/jinja2/filters.py | 22 +++++++++++++++++----- tests/test_filters.py | 11 ++++++----- 3 files changed, 29 insertions(+), 10 deletions(-) diff --git a/CHANGES.rst b/CHANGES.rst index bf670420c..ba3b2244e 100644 --- a/CHANGES.rst +++ b/CHANGES.rst @@ -5,6 +5,12 @@ Version 3.1.4 Unreleased +- The ``xmlattr`` filter does not allow keys with ``/`` solidus, ``>`` + greater-than sign, or ``=`` equals sign, in addition to disallowing spaces. + Regardless of any validation done by Jinja, user input should never be used + as keys to this filter, or must be separately validated first. + GHSA-h75v-3vvj-5mfj + Version 3.1.3 ------------- diff --git a/src/jinja2/filters.py b/src/jinja2/filters.py index 4cf3c11fb..acd11976e 100644 --- a/src/jinja2/filters.py +++ b/src/jinja2/filters.py @@ -250,7 +250,9 @@ def do_items(value: t.Union[t.Mapping[K, V], Undefined]) -> t.Iterator[t.Tuple[K yield from value.items() -_space_re = re.compile(r"\s", flags=re.ASCII) +# Check for characters that would move the parser state from key to value. +# https://html.spec.whatwg.org/#attribute-name-state +_attr_key_re = re.compile(r"[\s/>=]", flags=re.ASCII) @pass_eval_context @@ -259,8 +261,14 @@ def do_xmlattr( ) -> str: """Create an SGML/XML attribute string based on the items in a dict. - If any key contains a space, this fails with a ``ValueError``. Values that - are neither ``none`` nor ``undefined`` are automatically escaped. + **Values** that are neither ``none`` nor ``undefined`` are automatically + escaped, safely allowing untrusted user input. + + User input should not be used as **keys** to this filter. If any key + contains a space, ``/`` solidus, ``>`` greater-than sign, or ``=`` equals + sign, this fails with a ``ValueError``. Regardless of this, user input + should never be used as keys to this filter, or must be separately validated + first. .. sourcecode:: html+jinja @@ -280,6 +288,10 @@ def do_xmlattr( As you can see it automatically prepends a space in front of the item if the filter returned something unless the second parameter is false. + .. versionchanged:: 3.1.4 + Keys with ``/`` solidus, ``>`` greater-than sign, or ``=`` equals sign + are not allowed. + .. versionchanged:: 3.1.3 Keys with spaces are not allowed. """ @@ -289,8 +301,8 @@ def do_xmlattr( if value is None or isinstance(value, Undefined): continue - if _space_re.search(key) is not None: - raise ValueError(f"Spaces are not allowed in attributes: '{key}'") + if _attr_key_re.search(key) is not None: + raise ValueError(f"Invalid character in attribute name: {key!r}") items.append(f'{escape(key)}="{escape(value)}"') diff --git a/tests/test_filters.py b/tests/test_filters.py index f50ed13ab..d8e9114d0 100644 --- a/tests/test_filters.py +++ b/tests/test_filters.py @@ -474,11 +474,12 @@ def test_xmlattr(self, env): assert 'bar="23"' in out assert 'blub:blub="<?>"' in out - def test_xmlattr_key_with_spaces(self, env): - with pytest.raises(ValueError, match="Spaces are not allowed"): - env.from_string( - "{{ {'src=1 onerror=alert(1)': 'my_class'}|xmlattr }}" - ).render() + @pytest.mark.parametrize("sep", ("\t", "\n", "\f", " ", "/", ">", "=")) + def test_xmlattr_key_invalid(self, env: Environment, sep: str) -> None: + with pytest.raises(ValueError, match="Invalid character"): + env.from_string("{{ {key: 'my_class'}|xmlattr }}").render( + key=f"class{sep}onclick=alert(1)" + ) def test_sort1(self, env): tmpl = env.from_string("{{ [2, 3, 1]|sort }}|{{ [2, 3, 1]|sort(true) }}")