{"id":4316,"date":"2014-11-26T13:18:28","date_gmt":"2014-11-26T15:18:28","guid":{"rendered":"http:\/\/blog.plataformatec.com.br\/?p=4316"},"modified":"2015-06-01T12:28:45","modified_gmt":"2015-06-01T15:28:45","slug":"xss-vulnerability-on-simple-form-2","status":"publish","type":"post","link":"http:\/\/blog.plataformatec.com.br\/2014\/11\/xss-vulnerability-on-simple-form-2\/","title":{"rendered":"XSS vulnerability on Simple Form"},"content":{"rendered":"<p>There is a XSS vulnerability on Simple Form&#8217;s error options.<\/p>\n<ul>\n<li>Versions affected: >= 2.0.0<\/li>\n<li>Not affected: &lt; 2.0.0<\/li>\n<li>Fixed versions: 3.1.0, 3.0.3, 2.1.2<\/li>\n<\/ul>\n<h2>Impact<\/h2>\n<p>When Simple Form renders an error message it marks the text as being HTML safe, even though it may contain HTML tags. In applications where the error message can be provided by the users, malicious values can be provided and Simple Form will mark them as safe.<\/p>\n<h2>Changes at the behavior<\/h2>\n<p>To fix this vulnerability error messages are now always escaped. If users need to mark them as safe they will need to use explicitly the <code>:error<\/code> option:<\/p>\n<pre><code class=\"ruby\">f.input :name, error: raw(\"My &lt;b&gt;error&lt;\/b&gt;\")\n<\/code><\/pre>\n<h2>Releases<\/h2>\n<p>The 3.1.0, 3.0.3 and 2.1.2 releases are available at the regular locations.<\/p>\n<h2>Workarounds<\/h2>\n<p>There are no feasible workarounds for this issue. We recommend all users to upgrade as soon as possible.<\/p>\n<h2>Patches<\/h2>\n<p>To aid users who aren&#8217;t able to upgrade immediately we have provided patches. They are in git-am format and consist of a single changeset.<\/p>\n<ul>\n<li><a href=\"https:\/\/gist.github.com\/rafaelfranca\/843f7ec77cec39aabe75\">Patch for 3.0 series<\/a><\/li>\n<li><a href=\"https:\/\/gist.github.com\/rafaelfranca\/dc65bb34659e6027c24e\">Patch for 2.1 series<\/a><\/li>\n<\/ul>\n<h2>Credits<\/h2>\n<p>Thanks to Jake Goulding, from WhiteHat Security and Nicholas Rutherford from Medify Ltd. for reporting the issue and working with us in a fix.<\/p>\n<div style=\"padding:40px 0 20px;\">\n<a href=\"http:\/\/blog.plataformatec.com.br\/subscribe\/\"><img decoding=\"async\" src=\"http:\/\/blog.plataformatec.com.br\/wp-content\/uploads\/2014\/11\/subscribe-to-our-blog.png\" alt=\"Subscribe to our blog\" style=\"border:none;\" \/><\/a>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>There is a XSS vulnerability on Simple Form&#8217;s error options. Versions affected: >= 2.0.0 Not affected: &lt; 2.0.0 Fixed versions: 3.1.0, 3.0.3, 2.1.2 Impact When Simple Form renders an error message it marks the text as being HTML safe, even though it may contain HTML tags. In applications where the error message can be provided &#8230; <a class=\"read-more-link\" href=\"http:\/\/blog.plataformatec.com.br\/2014\/11\/xss-vulnerability-on-simple-form-2\/\">\u00bb<\/a><\/p>\n","protected":false},"author":15,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[1],"tags":[92,124,198],"aioseo_notices":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/4316"}],"collection":[{"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/comments?post=4316"}],"version-history":[{"count":12,"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/4316\/revisions"}],"predecessor-version":[{"id":4722,"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/posts\/4316\/revisions\/4722"}],"wp:attachment":[{"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/media?parent=4316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/categories?post=4316"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.plataformatec.com.br\/wp-json\/wp\/v2\/tags?post=4316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}