36 lines
1.9 KiB
Markdown
36 lines
1.9 KiB
Markdown
---
|
|
finding: "Stop marking JSON attributes as trusted HTML"
|
|
catalog: "Security"
|
|
impact: "Provider-controlled strings can break quoted data attributes on the watch page, creating an HTML injection risk."
|
|
base_commit: "0d31d46"
|
|
---
|
|
|
|
## Effort
|
|
|
|
S - localized template helper and tests.
|
|
|
|
## Risk
|
|
|
|
LOW - the intended behavior is still to serialize data for client-side parsing, but escaping must be handled by `html/template`.
|
|
|
|
## Confidence
|
|
|
|
HIGH - the current helper explicitly bypasses contextual escaping.
|
|
|
|
## Evidence
|
|
|
|
- `templates/funcs.go:37-42` marshals JSON and returns `template.HTMLAttr`.
|
|
- `templates/renderer.go:46-50` registers the helper as `json`.
|
|
- `templates/components/video_player.gohtml:10-12` embeds JSON inside single-quoted `data-*` attributes.
|
|
- `internal/playback/watch_data.go:181-188` copies provider subtitle labels into that serialized payload.
|
|
|
|
## Resolution Approach
|
|
|
|
Change the JSON serialization path so marshaled JSON is not marked as trusted `template.HTMLAttr`. Let `html/template` perform contextual escaping, or move larger JSON payloads into `<script type="application/json">` blocks where the template engine can safely escape script content.
|
|
|
|
The executor should preserve the client contract used by `static/player/state.ts`: the player still needs to read mode sources, available modes, and skip segments from the rendered page. If the storage location changes from `data-*` attributes to JSON script tags, update the parser in one place and add tests around that parser.
|
|
|
|
Add a template or renderer test that renders a watch-page-like payload containing apostrophes, double quotes, angle brackets, and ampersands in provider-controlled fields such as subtitle labels. The test should assert the rendered HTML does not create new attributes or tags and that the browser-side parser can recover the original data.
|
|
|
|
Verify with `go test ./templates ./internal/playback/...`, `bunx tsc -p tsconfig.json --noEmit`, and `bun test`.
|