fix: Reflected XSS on channels.nixos.org and releases.nixos.org
Additional hardening such as adding a CSP header will be done later on but it requires some additional upstream to be useful. Upstream already merged the fix we submitted: https://github.com/rufuspollock/s3-bucket-listing/commit/57ed3fa7be308ac82cfa18c99e207f1d1dc9ef74 Upgrading to the latest version of the s3-bucket-listing script seems to require additional changes and the security fix is small. It seems preferable to only deal with the security fix at this point and deal with the upgrade and potential complications later on. Fixes GHSA-3xg5-p8ch-832g
Thomas Gerbet committed
Aug 20, 2025 at 10:48 UTC
4030d7dc2585ec7ff52f2a80d9405c8a71fc93fa
1 file changed
+7
-5
terraform/s3_listing.html.tpl
+7
-5
@@ -174,8 +174,10 @@
174
var content = $.map(info.prefix.split('/'), function(pathSegment) {
175
processedPathSegments =
176
processedPathSegments + encodeURIComponent(pathSegment) + '/';
177
- return '<a href="?prefix=' + processedPathSegments + '">' + pathSegment +
178
- '</a>';
177
+ var link = document.createElement('a');
178
+ link.setAttribute('href', baseUrl + processedPathSegments.replace(/"/g, '"'));
179
+ link.innerText = pathSegment;
180
+ return link.outerHTML;
181
});
182
$('#navigation').html(root + content.join(' / '));
183
} else {
@@ -217,10 +219,10 @@
219
if (prefix) {
220
// make sure we end in /
221
var prefix = prefix.replace(/\/$/, '') + '/';
220
- s3_rest_url += '&prefix=' + prefix;
222
+ s3_rest_url += '&prefix=' + encodePath(prefix);
223
}
224
if (marker) {
223
- s3_rest_url += '&marker=' + marker;
225
+ s3_rest_url += '&marker=' + encodePath(marker);
226
}
227
return s3_rest_url;
228
}
@@ -287,7 +289,7 @@
289
LastModified: '',
290
Size: '',
291
keyText: '../',
290
- href: S3BL_IGNORE_PATH ? '?prefix=' + up : '../'
292
+ href: S3BL_IGNORE_PATH ? '?prefix=' + encodePath(up) : '../'
293
},
294
row = renderRow(item, cols);
295
content.push(row + '\n');