From e49282327b05192e46086bf25fd3ac691205fe80 Mon Sep 17 00:00:00 2001 From: Roland Shoemaker Date: Thu, 13 Apr 2023 15:40:44 -0700 Subject: [PATCH] [release-branch.go1.19] html/template: disallow angle brackets in CSS values Change-Id: Iccc659c9a18415992b0c05c178792228e3a7bae4 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1826636 Reviewed-by: Julie Qiu Run-TryBot: Roland Shoemaker Reviewed-by: Damien Neil Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1851496 Run-TryBot: Damien Neil Reviewed-by: Roland Shoemaker Reviewed-on: https://go-review.googlesource.com/c/go/+/491335 Run-TryBot: Carlos Amedee Reviewed-by: Dmitri Shuralyov TryBot-Result: Gopher Robot Upstream-Status: Backport [https://github.com/golang/go/commit/e49282327b05192e46086bf25fd3ac691205fe80] CVE: CVE-2023-24539 Signed-off-by: Vivek Kumbhar --- src/html/template/css.go | 2 +- src/html/template/css_test.go | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/html/template/css.go b/src/html/template/css.go index 890a0c6b227fe..f650d8b3e843a 100644 --- a/src/html/template/css.go +++ b/src/html/template/css.go @@ -238,7 +238,7 @@ func cssValueFilter(args ...any) string { // inside a string that might embed JavaScript source. for i, c := range b { switch c { - case 0, '"', '\'', '(', ')', '/', ';', '@', '[', '\\', ']', '`', '{', '}': + case 0, '"', '\'', '(', ')', '/', ';', '@', '[', '\\', ']', '`', '{', '}', '<', '>': return filterFailsafe case '-': // Disallow . diff --git a/src/html/template/css_test.go b/src/html/template/css_test.go index a735638b0314f..2b76256a766e9 100644 --- a/src/html/template/css_test.go +++ b/src/html/template/css_test.go @@ -231,6 +231,8 @@ func TestCSSValueFilter(t *testing.T) { {`-exp\000052 ession(alert(1337))`, "ZgotmplZ"}, {`-expre\0000073sion`, "-expre\x073sion"}, {`@import url evil.css`, "ZgotmplZ"}, + {"<", "ZgotmplZ"}, + {">", "ZgotmplZ"}, } for _, test := range tests { got := cssValueFilter(test.css)