Fix possible XSS : jbox-web#199

Nicolas Rodriguez · Nicolas Rodriguez · commit 888b281ee08d · 2017-04-15T04:03:43.000+02:00
diff --git a/lib/ajax-datatables-rails/base.rb b/lib/ajax-datatables-rails/base.rb
@@ -38,7 +38,7 @@ def as_json(options = {})
       {
         recordsTotal: get_raw_records.count(:all),
         recordsFiltered: get_raw_records.model.from("(#{filter_records(get_raw_records).except(:limit, :offset, :order).to_sql}) AS foo").count,
-        data: data
+        data: sanitize(data)
       }
     end
 
@@ -69,6 +69,16 @@ def connected_columns
 
     private
 
+    def sanitize(data)
+      data.map do |record|
+        if record.is_a?(Array)
+          record.map { |td| ERB::Util.html_escape(td) }
+        else
+          record.update(record){ |_, v| ERB::Util.html_escape(v) }
+        end
+      end
+    end
+
     def retrieve_records
       records = fetch_records
       records = filter_records(records)
diff --git a/spec/ajax-datatables-rails/base_spec.rb b/spec/ajax-datatables-rails/base_spec.rb
@@ -51,6 +51,15 @@
           item = datatable.data.first
           expect(item).to be_a(Hash)
         end
+
+        it 'should html escape data' do
+          datatable = ComplexDatatableHash.new(view)
+          create(:user, first_name: 'Name "><img src=x onerror=alert("first_name")>', last_name: 'Name "><img src=x onerror=alert("last_name")>')
+          data = datatable.send(:sanitize, datatable.data)
+          item = data.first
+          expect(item[:first_name]).to eq 'Name &quot;&gt;&lt;img src=x onerror=alert(&quot;first_name&quot;)&gt;'
+          expect(item[:last_name]).to eq 'Name &quot;&gt;&lt;img src=x onerror=alert(&quot;last_name&quot;)&gt;'
+        end
       end
 
       context 'when data is defined as a array' do
@@ -62,6 +71,15 @@
           item = datatable.data.first
           expect(item).to be_a(Array)
         end
+
+        it 'should html escape data' do
+          datatable = ComplexDatatableArray.new(view)
+          create(:user, first_name: 'Name "><img src=x onerror=alert("first_name")>', last_name: 'Name "><img src=x onerror=alert("last_name")>')
+          data = datatable.send(:sanitize, datatable.data)
+          item = data.first
+          expect(item[2]).to eq 'Name &quot;&gt;&lt;img src=x onerror=alert(&quot;first_name&quot;)&gt;'
+          expect(item[3]).to eq 'Name &quot;&gt;&lt;img src=x onerror=alert(&quot;last_name&quot;)&gt;'
+        end
       end
 
     end
