fix(trace-viewer): sanitize snapshot renderer against XSS from crafted traces#40655
fix(trace-viewer): sanitize snapshot renderer against XSS from crafted traces#40655SebTardif wants to merge 1 commit intomicrosoft:mainfrom
Conversation
…d traces The snapshot renderer did not filter SCRIPT elements or sanitize the doctype field. A crafted trace file could inject a SCRIPT node into snapshot JSON or use a malicious doctype value to break out of the DOCTYPE declaration and execute arbitrary JavaScript in the trace viewer context. The capture side (snapshotterInjected.ts) already strips SCRIPT elements, but trace files are untrusted input and the renderer must not rely on the capture side for safety. - Skip SCRIPT elements in the renderer (mirrors snapshotterInjected.ts:364) - Sanitize doctype to alphanumeric only (valid doctype names are always alphanumeric) Follows the same defense-in-depth pattern as microsoft#40115 and microsoft#14325.
|
I'll accept the patch, but this vector of attack has been previously discovered and considered to not be a threat. trace.playwright.dev is designed to not manage user data. Looking at the vulnerabilities you report, you are going over the results of the same model we have access to. |
Test results for "MCP"10 failed 6933 passed, 1052 skipped Merge workflow run. |
Test results for "tests 1"1 failed 2 flaky41652 passed, 851 skipped Merge workflow run. |
2 participants
Summary
["SCRIPT", {}, "alert(1)"]into snapshot JSON or use a malicious doctype value to break out of the DOCTYPE declaration and execute arbitrary JavaScript in the trace viewer context.snapshotterInjected.ts) already strips SCRIPT elements and sanitizes attributes, but trace files are untrusted input and the renderer must not rely on the capture side for safety.snapshotterInjected.ts:364)Follows the same defense-in-depth pattern as #40115 and #14325.