starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #255] [MERGED] Template Fixes #1347

New Issue
Closed
opened 2025-12-29 02:29:46 +01:00 by adam · 0 comments
adam commented 2025-12-29 02:29:46 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/255
Author: @Wakeful-Cloud
Created: 12/23/2021
Status: ✅ Merged
Merged: 12/24/2021
Merged by: @juanfont

Base: main ← Head: main

📝 Commits (1)

📊 Changes

4 files changed (+91 additions, -37 deletions)

View changed files

📝 api.go (+36 -14)
📝 apple_mobileconfig.go (+1 -1)
📝 oidc.go (+53 -21)
📝 swagger.go (+1 -1)

📄 Description

Description

This pull request fixes a number of template errors resulting in XSS vulnerabilities.

Security Advisory

I recommend creating a GitHub security advisory with the following:

  • Affected product
    • Ecosystem: Go
    • Package name: github.com/juanfont/headscale
    • Affected versions: unknown
    • Patches versions: TBD
  • Severity: Assess severity using CVSS
  • Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
  • CWE: 74
  • CVE identifier: Request CVE ID later
  • Title: Unsanitized HTML Template Evaluation
  • Description:

Impact

If the Tailscale client were to be compromised, it could instruct users to go to
a malicious URL where said client has total control over content on the Headscale
webpage due to incorrect template evaluation. For example, if you visit
/register?key=<script>alert('XSS')</script> on a Headscale control server, you'll
see an alert box.

Patches

TBD

Workarounds

Analyze all Headscale URLs for suspicious content (Especially percent-encoded query parameters)

References

@juanfont

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/255 **Author:** [@Wakeful-Cloud](https://github.com/Wakeful-Cloud) **Created:** 12/23/2021 **Status:** ✅ Merged **Merged:** 12/24/2021 **Merged by:** [@juanfont](https://github.com/juanfont) **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (1) - [`1c7cb98`](https://github.com/juanfont/headscale/commit/1c7cb98042d098ea3a86fb349f9a3c3ff4632110) Template Fixes ### 📊 Changes **4 files changed** (+91 additions, -37 deletions) <details> <summary>View changed files</summary> 📝 `api.go` (+36 -14) 📝 `apple_mobileconfig.go` (+1 -1) 📝 `oidc.go` (+53 -21) 📝 `swagger.go` (+1 -1) </details> ### 📄 Description ## Description This pull request fixes a number of template errors resulting in XSS vulnerabilities. ## Security Advisory I recommend creating a [GitHub security advisory](https://docs.github.com/en/code-security/security-advisories/creating-a-security-advisory) with the following: * Affected product * Ecosystem: `Go` * Package name: `github.com/juanfont/headscale` * Affected versions: unknown * Patches versions: TBD * Severity: `Assess severity using CVSS` * Vector string: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N` * CWE: [74](https://cwe.mitre.org/data/definitions/74.html) * CVE identifier: `Request CVE ID later` * Title: `Unsanitized HTML Template Evaluation` * Description: ### Impact If the Tailscale client were to be compromised, it could instruct users to go to a malicious URL where said client has **total** control over content on the Headscale webpage due to incorrect template evaluation. For example, if you visit `/register?key=<script>alert('XSS')</script>` on a Headscale control server, you'll see an alert box. ### Patches TBD ### Workarounds Analyze all Headscale URLs for suspicious content (Especially percent-encoded query parameters) ### References * [html/template](https://pkg.go.dev/html/template) --- @juanfont --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 02:29:46 +01:00
adam closed this issue 2025-12-29 02:29:46 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1347
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?