Security Fix for Cross-site Scripting (XSS) - huntr.dev

[huntr-helper]

https://huntr.dev/users/mufeedvh has fixed the Cross-site Scripting (XSS) vulnerability 🔨. mufeedvh has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#1
GitHub Issue | #1130
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/npm/x-editable/1/README.md

User Comments:

📊 Metadata *

Bounty URL: https://www.huntr.dev/bounties/1-npm-x-editable

⚙️ Description *

The project x-editable validated JSON string with poorly crafted Regex making it easy to bypass the validation and inject JavaScript code to achieve XSS (Cross-site Scripting).

💻 Technical Description *

The implemented Regex to validate JSON was so poor that it only checks whether if the string begins and ends with [ or { and their counterparts ] or }. This means you can give it a string such as []+alert(1)+[] and it will match.

Come on man why would you write a whole Regex to validate JSON semantics lol, and JavaScript's Regex match doesn't have certain expressions implemented making it even harder.

So how do we fix it? Just parse the JSON with the JavaScript function JSON.parse() and if it fails, it's not a valid JSON string.

🐛 Proof of Concept (PoC) *

Refer: #1130

Payload used to bypass the current validation:

[]+alert(1)+[]

🔥 Proof of Fix (PoF) *

Parse the input JSON string and if it fails, it wouldn't proceed dynamically adding it to the HTML code preventing the XSS (Cross-site Scripting) vulnerability.

if (typeof s === 'string' && s.length) {
    try {
        JSON.parse(s);
        if (safe) {
            try {
                /*jslint evil: true*/
                s = (new Function('return ' + s))();
                /*jslint evil: false*/
            } catch (e) {} finally {
                return s;
            }
        } else {
            /*jslint evil: true*/
            s = (new Function('return ' + s))();
            /*jslint evil: false*/
        }
        return s;
    } catch (e) {
        // pass
    }
}

👍 User Acceptance Testing (UAT)

Just added a try/catch block to check for JSON.parse() fails.

[JamieSlome]

@vitalets - let me know if you have any questions or thoughts?

Cheers! 🍰