GitHub Advisoryadvisory · crates.io
GHSA-v33j-v3x4-42qg Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
MEDIUM
Official page ↗
- Ecosystem
- crates.io
- Packages
- hurl
- Severity
- Moderate
- Reviewed
- 2025-06-11
Affected packages
• crates.io hurl: < 7.0.0 → fixed in 7.0.0
Description
Given this Hurl file:
regex.hurl:
```
GET https://foo.com
HTTP 200
[Asserts]
jsonpath "$.body" matches //
```
When exported to HTML:
```
$ hurlfmt --out html regex.hurl
GET https://foo.com
HTTP 200
[Asserts]
jsonpath "$.body" matches //
```
The regex literal `//` is not escaped:
`//`
When opened in a browser, the code is run without user interaction:
References
- https://github.com/Orange-OpenSource/hurl/security/advisories/GHSA-v33j-v3x4-42qg web
- https://github.com/Orange-OpenSource/hurl/commit/248ac41cfa1797c52241c6ef756490d90027cdf2 web
- https://github.com/Orange-OpenSource/hurl/commit/7dcdbd1796785392b1e829d1f07c6687b9a8f27d web
- https://github.com/Orange-OpenSource/hurl package