starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Newline in markdown links bypasses XSS filter #6447

New Issue
Closed
opened 2025-12-29 19:40:49 +01:00 by adam · 0 comments
adam commented 2025-12-29 19:40:49 +01:00
Owner
Copy Link

Originally created by @magicOz on GitHub (May 4, 2022).

Originally assigned to: @jeremystretch on GitHub.

NetBox version

v.3.2.2

Python version

3.8

Steps to Reproduce

The markdown filter fails to sanitize/strip links and references which contains newlines (\n).

8d682041a4/netbox/utilities/templatetags/builtins/filters.py (L153-L158)

The following payload will produce two links which both will trigger a XSS when clicked.

[XSS1][a]
[a
]: javascript:alert(/XSS1/)

[XSS2](
javascript:alert(/XSS2/))

Expected Behavior

Maybe add the flag re.DOTALL to the regexp?

Observed Behavior

XSS

Originally created by @magicOz on GitHub (May 4, 2022). Originally assigned to: @jeremystretch on GitHub. ### NetBox version v.3.2.2 ### Python version 3.8 ### Steps to Reproduce The markdown filter fails to sanitize/strip links and references which contains newlines (\n). https://github.com/netbox-community/netbox/blob/8d682041a43b6176198f64bd80a46ea9ed99d2d8/netbox/utilities/templatetags/builtins/filters.py#L153-L158 The following payload will produce two links which both will trigger a XSS when clicked. ``` [XSS1][a] [a ]: javascript:alert(/XSS1/) [XSS2]( javascript:alert(/XSS2/)) ``` ### Expected Behavior Maybe add the flag `re.DOTALL` to the regexp? ### Observed Behavior XSS
adam added the type: bugstatus: accepted labels 2025-12-29 19:40:49 +01:00
adam closed this issue 2025-12-29 19:40:49 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#6447
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?