appsmith icon indicating copy to clipboard operation
appsmith copied to clipboard

Published 20 hours ago • verified publisher icon appsmithorg

chore: fix list widget data parsing

Open arunvjn opened this issue 2 years ago • 6 comments

Description

The usage of single quote to parse the field values in a list widget opened up the possibility of XSS in list widget. The line {{((currentItem) => { ${next}})(JSON.parse('${escapedStringifiedListItem}'))}} can be manipulated the following way. Let say, the escapedStringifiedListItem's value is a JSON that looks like this {"username": '+showAlert(1.toString())+'}, then {{((currentItem) => { ${next}})(JSON.parse('{"username" : '+showAlert(1.toString())+'}'))}} would parse incorrectly and showAlert would get executed when this snippet is sent for evaluation.

Type of change

  • Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

  • Manual

Checklist:

  • [ ] My code follows the style guidelines of this project
  • [ ] I have performed a self-review of my own code
  • [ ] I have commented my code, particularly in hard-to-understand areas
  • [ ] I have made corresponding changes to the documentation
  • [ ] My changes generate no new warnings
  • [ ] I have added tests that prove my fix is effective or that my feature works
  • [ ] New and existing unit tests pass locally with my changes

arunvjn avatar Oct 18 '22 11:10 arunvjn

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Updated
appsmith ✅ Ready (Inspect) Visit Preview Oct 20, 2022 at 8:21AM (UTC)

vercel[bot] avatar Oct 18 '22 11:10 vercel[bot]

/ok-to-test sha=0ba13cc

arunvjn avatar Oct 18 '22 11:10 arunvjn

Unable to find test scripts. Please add necessary tests to the PR.

github-actions[bot] avatar Oct 18 '22 12:10 github-actions[bot]

/ok-to-test sha=c0f2969

arunvjn avatar Oct 18 '22 13:10 arunvjn

Tests running at: https://github.com/appsmithorg/appsmith/actions/runs/3273533441. Workflow: Appsmith External Integration Test Workflow. Commit: 0ba13cc. PR: 17666. Perf tests will be available at https://app.appsmith.com/app/performance-infra-dashboard/pr-details-63465d4789020c7ac296d08d?pr=17666&runId=3273533441_1

github-actions[bot] avatar Oct 18 '22 13:10 github-actions[bot]

Tests running at: https://github.com/appsmithorg/appsmith/actions/runs/3273951404. Workflow: Appsmith External Integration Test Workflow. Commit: c0f2969. PR: 17666. Perf tests will be available at https://app.appsmith.com/app/performance-infra-dashboard/pr-details-63465d4789020c7ac296d08d?pr=17666&runId=3273951404_1

github-actions[bot] avatar Oct 18 '22 15:10 github-actions[bot]

/ok-to-test sha=c0f2969

arunvjn avatar Oct 19 '22 05:10 arunvjn

Tests running at: https://github.com/appsmithorg/appsmith/actions/runs/3279120590. Workflow: Appsmith External Integration Test Workflow. Commit: c0f2969. PR: 17666. Perf tests will be available at https://app.appsmith.com/app/performance-infra-dashboard/pr-details-63465d4789020c7ac296d08d?pr=17666&runId=3279120590_1

github-actions[bot] avatar Oct 19 '22 06:10 github-actions[bot]

Deployment failed with the following error:

Resource is limited - try again in 23 minutes (more than 100, code: "api-deployments-free-per-day").

vercel[bot] avatar Oct 19 '22 09:10 vercel[bot]

Deployment failed with the following error:

Resource is limited - try again in 6 minutes (more than 100, code: "api-deployments-free-per-day").

vercel[bot] avatar Oct 19 '22 10:10 vercel[bot]

/ok-to-test sha=f3b516d

arunvjn avatar Oct 19 '22 10:10 arunvjn

/ok-to-test sha=2f35113

arunvjn avatar Oct 19 '22 13:10 arunvjn

Tests running at: https://github.com/appsmithorg/appsmith/actions/runs/3281668976. Workflow: Appsmith External Integration Test Workflow. Commit: f3b516d. PR: 17666. Perf tests will be available at https://app.appsmith.com/app/performance-infra-dashboard/pr-details-63465d4789020c7ac296d08d?pr=17666&runId=3281668976_1

github-actions[bot] avatar Oct 19 '22 14:10 github-actions[bot]

Tests running at: https://github.com/appsmithorg/appsmith/actions/runs/3282283401. Workflow: Appsmith External Integration Test Workflow. Commit: 2f35113. PR: 17666. Perf tests will be available at https://app.appsmith.com/app/performance-infra-dashboard/pr-details-63465d4789020c7ac296d08d?pr=17666&runId=3282283401_1

github-actions[bot] avatar Oct 19 '22 15:10 github-actions[bot]

/ok-to-test sha=6cbfc02

arunvjn avatar Oct 20 '22 08:10 arunvjn

Tests running at: https://github.com/appsmithorg/appsmith/actions/runs/3287985429. Workflow: Appsmith External Integration Test Workflow. Commit: 6cbfc02. PR: 17666. Perf tests will be available at https://app.appsmith.com/app/performance-infra-dashboard/pr-details-63465d4789020c7ac296d08d?pr=17666&runId=3287985429_1

github-actions[bot] avatar Oct 20 '22 08:10 github-actions[bot]