A05: validate the update feed ReleaseUrl scheme #19

New issue

Closed

opened 2026-08-13 09:35:05 +00:00 by nalum · 0 comments

nalum commented

2026-08-13 09:35:05 +00:00

Owner

Admin.tsx:2089 renders <a href={update.url}> straight from the update feed's JSON (internal/services/system/update_rpc.go:96, html_url from the configured Gitea feed). A compromised or malicious feed could supply a javascript: URL — React only console-warns on those and still renders them.

Admin-only page and operator-configured feed, so exploitation needs feed compromise.

Fix: server-side scheme check on ReleaseUrl — accept http/https only, drop anything else.

Source: OWASP Top 10 (2025) audit of v1.1.0, 2026-08-13. File references point at the v1.1.0 tree.

`Admin.tsx:2089` renders `<a href={update.url}>` straight from the update feed's JSON (`internal/services/system/update_rpc.go:96`, `html_url` from the configured Gitea feed). A compromised or malicious feed could supply a `javascript:` URL — React only console-warns on those and still renders them. Admin-only page and operator-configured feed, so exploitation needs feed compromise. **Fix**: server-side scheme check on `ReleaseUrl` — accept `http`/`https` only, drop anything else. --- Source: OWASP Top 10 (2025) audit of `v1.1.0`, 2026-08-13. File references point at the `v1.1.0` tree.

nalum added this to the v1.1.0 security audit milestone

2026-08-13 09:35:05 +00:00

nalum added the

web

security

severity/low

labels

2026-08-13 09:35:05 +00:00

nalum added reference refs/tags/v1.1.0

2026-08-13 09:37:48 +00:00

nalum referenced this issue from a commit

2026-08-13 10:07:34 +00:00