From 406e87a0a48c537fb169025d4b733374aae125aa Mon Sep 17 00:00:00 2001 From: Eric Gu Date: Sat, 11 Jul 2026 23:22:42 -0400 Subject: [PATCH] Fix stored XSS in HTML report via unescaped Location: header (#3090) Backport of the 3.3dev fix to the 3.2 branch. pr_url() and pr_boldurl() interpolated their argument directly into $1 without HTML escaping. The most notable caller passes the raw HTTP Location: header from the scanned server, so a malicious HTTPS target could inject arbitrary HTML/JS into an operator's --htmlfile report. Route both the href attribute and the link text through the existing html_reserved() escaper, matching the pattern already used by every other pr_* HTML-output function. --- CHANGELOG.md | 4 ++++ CREDITS.md | 3 +++ testssl.sh | 4 ++-- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b70b1f3..855842b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,10 @@ ## Change Log +### Security fixes in 3.2.x + +* Security fix: HTML-escape URLs in the HTML report to prevent stored XSS from a server-controlled `Location:` header (#3090) + ### Features implemented / improvements in 3.2 * Rating (SSL Labs), as of 3.2.2 version 2009r diff --git a/CREDITS.md b/CREDITS.md index 1667f5d..6ac1b0e 100644 --- a/CREDITS.md +++ b/CREDITS.md @@ -68,6 +68,9 @@ Full contribution, see git log. * Christian Dresen - Dockerfile +* Eric Gu + - HTML report XSS fix (escape server-controlled URLs, #3090) + * enxio - support for TN3270/telnet STARTTLS diff --git a/testssl.sh b/testssl.sh index 0ffb4ea..eab9719 100755 --- a/testssl.sh +++ b/testssl.sh @@ -739,8 +739,8 @@ tmln_fixme() { tmln_warning "Fixme: $1"; } pr_fixme() { pr_warning "Fixme: $1"; } prln_fixme() { prln_warning "Fixme: $1"; } -pr_url() { tm_out "$1"; html_out "$1"; } -pr_boldurl() { tm_bold "$1"; html_out "$1"; } +pr_url() { tm_out "$1"; html_out "$(html_reserved "$1")"; } +pr_boldurl() { tm_bold "$1"; html_out "$(html_reserved "$1")"; } ### color switcher (see e.g. https://linuxtidbits.wordpress.com/2008/08/11/output-color-on-bash-scripts/ ### https://www.tldp.org/HOWTO/Bash-Prompt-HOWTO/x405.html