security(contribs/gnodev/pkg/emitter): use html/template not text/tem…

…plate for HTML generation This change uses html/template instead of text/template for HTML generation and also locks in tests to detect such subtle regressions and thus help prevent future cross-side scripting (XSS) attacks if later the scripts evolve and take in user input. Fixes #3544
gnolang · Jan 19, 2025 · c014723 · c014723
1 parent d2813f8
commit c014723
Show file tree

Hide file tree

Showing 3 changed files with 49 additions and 1 deletion.
diff --git a/contribs/gnodev/go.mod b/contribs/gnodev/go.mod
@@ -16,6 +16,7 @@ require (
 	github.com/charmbracelet/wish v1.4.0
 	github.com/fsnotify/fsnotify v1.7.0
 	github.com/gnolang/gno v0.0.0-00010101000000-000000000000
+	github.com/google/go-cmp v0.6.0
 	github.com/gorilla/websocket v1.5.3
 	github.com/lrstanley/bubblezone v0.0.0-20240624011428-67235275f80c
 	github.com/muesli/reflow v0.3.0

diff --git a/contribs/gnodev/pkg/emitter/middleware.go b/contribs/gnodev/pkg/emitter/middleware.go
@@ -5,10 +5,10 @@ import (
 	_ "embed"
 	"encoding/json"
 	"fmt"
+	"html/template"
 	"net/http"
 	"strings"
 	"sync"
-	"text/template"
 
 	"github.com/gnolang/gno/contribs/gnodev/pkg/events"
 )

diff --git a/contribs/gnodev/pkg/emitter/middleware_test.go b/contribs/gnodev/pkg/emitter/middleware_test.go
@@ -0,0 +1,47 @@
+package emitter
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"regexp"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestMiddlewareUsesHTMLTemplate(t *testing.T) {
+	tests := []struct {
+		name   string
+		remote string
+		want   string
+	}{
+		{"normal remote", "localhost:9999", "const ws = new WebSocket('ws://localhost:9999');"},
+		{"xss'd remote", `localhost:9999');alert('pwned`, "const ws = new WebSocket('ws://localhost:9999&#39;);alert(&#39;pwned');"},
+	}
+
+        // As the code revolves, add more search patterns here.
+	var reWebsocket = regexp.MustCompile("const ws = new WebSocket[^\n]+")
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			mdw := NewMiddleware(tt.remote, http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+				rw.Header().Set("Content-Type", "text/html")
+				fmt.Fprintf(rw, "<body></body>")
+			}))
+			rec.Header().Set("Content-Type", "text/html")
+			req := httptest.NewRequest("GET", "https://gno.land/example", nil)
+			mdw.ServeHTTP(rec, req)
+
+			targets := reWebsocket.FindAllString(rec.Body.String(), -1)
+			if len(targets) == 0 {
+				t.Fatal("Could not find the desired targets")
+			}
+			body := targets[0]
+			if diff := cmp.Diff(string(body), tt.want); diff != "" {
+				t.Fatalf("Response mismatch: got - want +\n%s", diff)
+			}
+		})
+	}
+}