fix: escape user-controlled data in order.log() and objects_to_hyperlinks() - #2522
Open
TempleOfSats wants to merge 5 commits into
Open
fix: escape user-controlled data in order.log() and objects_to_hyperlinks()#2522TempleOfSats wants to merge 5 commits into
TempleOfSats wants to merge 5 commits into
Conversation
…inks() - api/models/order.py: escape() level and event before storing in logs to prevent XSS via order IDs, usernames, addresses, descriptions etc. - api/utils.py: escape() entire logs string before regex substitution in objects_to_hyperlinks() as defense-in-depth against injected HTML/JS
Contributor
|
The change in |
gabbygator184
added a commit
that referenced
this pull request
Jul 16, 2026
…inks() - api/models/order.py: escape() level and event before storing in logs to prevent XSS via order IDs, usernames, addresses, descriptions etc. - api/utils.py: escape() entire logs string before regex substitution in objects_to_hyperlinks() as defense-in-depth against injected HTML/JS #2522
gabbygator184
previously approved these changes
Aug 1, 2026
Contributor
|
As @jerryfletcher21 pointed out, this will break the rendering. There are also places in the code that add logs containing HTML tags. I think we should fix this by converting the logs column into a JSON column, then having the log message containing plain-text only, but with a few special behavior, like the existing |
KoalaSat
previously approved these changes
Aug 7, 2026
KoalaSat
self-requested a review
August 7, 2026 09:28
Member
|
@TempleOfSats any update on this? |
gabbygator184
previously approved these changes
Aug 7, 2026
TempleOfSats
dismissed stale reviews from gabbygator184 and KoalaSat
via
August 12, 2026 07:17
c1831bc
| except Exception as e: | ||
| html_logs = f"An error occurred while formatting the parsed logs as HTML. Exception {e}" | ||
| return html_logs | ||
| return format_html(render_order_logs(obj.logs)) |
Contributor
There was a problem hiding this comment.
It make more sense to use mark_safe instead of format_html. I wrote the reason in this PR: #2423.
Contributor
|
Well done! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
1. api/models/order.py — log() method
2. api/utils.py — objects_to_hyperlinks() function
Security Impact
Both fixes prevent XSS attacks via the order logs system.