Improve HTML/Markdown sanitization #14

New Issue

fox · 2022-11-16T16:03:51Z

fox commented

2022-11-16 16:03:51 +00:00

The recent exploit required HTML formatting. Glitch has an open issue for Markdown rendering. Other vulnerabilities likely exist.

Removing the option to create posts in HTML/Markdown is trivial, but to disable rendering recieved HTML/Markdown posts is much more integrated.

Perhaps the ability to toggle HTML/Markdown formatting instance wide is an upstream feature request. Disabling these features also breaks previously formatted posts (it will look the same as sending HTML formatting to an instance that does not support HTML formatting).

The recent exploit required HTML formatting. Glitch has an open issue for Markdown rendering. Other vulnerabilities likely exist. Removing the option to create posts in HTML/Markdown is trivial, but to disable rendering recieved HTML/Markdown posts is much more integrated. Perhaps the ability to toggle HTML/Markdown formatting instance wide is an upstream feature request. Disabling these features also breaks previously formatted posts (it will look the same as sending HTML formatting to an instance that does not support HTML formatting).

kouhai commented

2022-11-16 17:18:53 +00:00

I use markdown formatting a lot, so disabling markdown is a "won't fix". However, it's probably worth looking into better sanitization.

kouhai changed title from ~~Disable HTML and Markdown Formatting~~ to Improve HTML/Markdown sanitization

2022-11-16 17:19:21 +00:00

fox commented

2022-11-16 17:57:20 +00:00

Poster

I am not against Markdown (I'd prefer others to beta test 😅).

HTML I'd hope to deprecate.

The PoC of the last exploit looked scary by stealing autofill passwords, but much more was possible. They could inject iframes. The vulnerability was only in Glitch, but upstream Mastodon fixed it--which makes me question Glitch.

I am not against Markdown (I'd prefer others to beta test 😅). HTML I'd hope to deprecate. The PoC of the last exploit looked scary by stealing autofill passwords, but much more was possible. They could inject iframes. The vulnerability was only in Glitch, but upstream Mastodon fixed it--which makes me question Glitch.

eureka commented

2022-11-17 17:32:50 +00:00

We discussed this on Discord briefly, so just recapping: I think the best route here is to entity encode the entire non-text (excluding "safe" symbol) input before doing Markdown processing. Doing sanitiziation is prone to errors and corner cases, even if we use a full blown HTML parser to do it. A lot of injection bugs rely on malformed tags to escape parser-based sanitization, so just forbidding them from appearing unencoded seems like the best route. This does bloat the size of the toot data, but it seems worthwhile.

👍 1

fox added the

type/enhancement

tag/help wanted

priority/3.low

labels 2022-12-03 15:36:50 +00:00

Sign in to join this conversation.