Skip to content

fix: escape user-controlled data in order.log() and objects_to_hyperlinks() #2522

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TempleOfSats wants to merge 5 commits into
base: main
Choose a base branch
from
Open

fix: escape user-controlled data in order.log() and objects_to_hyperlinks() #2522

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a23c96b
fix: escape user-controlled data in order.log() and objects_to_hyperl…
Jul 5, 2026
71421fd
Merge branch 'main' into pr-20260705-170319-xss-escape-order-logs
KoalaSat Aug 7, 2026
7f798bf
Merge branch 'main' into pr-20260705-170319-xss-escape-order-logs
KoalaSat Aug 7, 2026
5a755f4
Merge branch 'main' into pr-20260705-170319-xss-escape-order-logs
KoalaSat Aug 7, 2026
c1831bc
fix: store order logs as JSON instead of HTML (resolves XSS)
Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 2 additions & 11 deletions api/admin.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@

from api.logics import Logics
from api.models import Currency, LNPayment, MarketTick, OnchainPayment, Order, Robot
from api.utils import objects_to_hyperlinks
from api.utils import render_order_logs
from api.tasks import send_notification

admin.site.unregister(Group)
Expand Down Expand Up @@ -130,16 +130,7 @@ class OrderAdmin(AdminChangeLinksMixin, admin.ModelAdmin):
readonly_fields = ("reference", "_logs")

def _logs(self, obj):
if not obj.logs:
return format_html("<b>No logs were recorded</b>")
with_hyperlinks = objects_to_hyperlinks(obj.logs)
try:
html_logs = format_html(
f'<table style="width: 100%">{with_hyperlinks}</table>'
)
except Exception as e:
html_logs = f"An error occurred while formatting the parsed logs as HTML. Exception {e}"
return html_logs
return format_html(render_order_logs(obj.logs))

@alicecoordinator alicecoordinator Aug 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It make more sense to use mark_safe instead of format_html. I wrote the reason in this PR: #2423.


actions = [
"cancel_public_order",
Expand Down
6 changes: 3 additions & 3 deletions api/lightning/cln.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -656,7 +656,7 @@ def handle_response():
order.save(update_fields=["expires_at"])

order.log(
f"Payment LNPayment({lnpayment.payment_hash},{str(lnpayment)}) <b>succeeded</b>"
f"Payment LNPayment({lnpayment.payment_hash},{str(lnpayment)}) **succeeded**"
)

results = {"succeded": True}
Expand Down Expand Up @@ -710,7 +710,7 @@ def handle_response():
f"Order: {order.id} FAILED. Hash: {hash} Reason: {cls.payment_failure_context[status_code]}"
)
order.log(
f"Payment LNPayment({lnpayment.payment_hash},{str(lnpayment)}) <b>failed</b>. Failure reason: {cls.payment_failure_context[status_code]}"
f"Payment LNPayment({lnpayment.payment_hash},{str(lnpayment)}) **failed**. Failure reason: {cls.payment_failure_context[status_code]}"
)

return {
Expand Down Expand Up @@ -747,7 +747,7 @@ def handle_response():
order.save(update_fields=["expires_at"])

order.log(
f"Payment LNPayment({lnpayment.payment_hash},{str(lnpayment)}) <b>had expired</b>"
f"Payment LNPayment({lnpayment.payment_hash},{str(lnpayment)}) **had expired**"
)

results = {
Expand Down
8 changes: 4 additions & 4 deletions api/lightning/lnd.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -199,7 +199,7 @@ def pay_onchain(cls, onchainpayment, queue_code=5, on_mempool_code=2):
onchainpayment.broadcasted = True
onchainpayment.save(update_fields=["txid", "broadcasted"])
onchainpayment.order_paid_TX.log(
f"TX OnchainPayment({onchainpayment.id},{response.txid}) in <b>mempool</b>"
f"TX OnchainPayment({onchainpayment.id},{response.txid}) in **mempool**"
)
return True

Expand Down Expand Up @@ -608,7 +608,7 @@ def handle_response(response, was_in_transit=False):
f"Order: {order.id} FAILED. Hash: {hash} Reason: {str_failure_reason}"
)
order.log(
f"Payment LNPayment({lnpayment.payment_hash},{str(lnpayment)}) <b>failed</b>. Failure reason: {str_failure_reason})"
f"Payment LNPayment({lnpayment.payment_hash},{str(lnpayment)}) **failed**. Failure reason: {str_failure_reason})"
)

return {
Expand All @@ -632,7 +632,7 @@ def handle_response(response, was_in_transit=False):
order.save(update_fields=["expires_at"])

order.log(
f"Payment LNPayment({lnpayment.payment_hash},{str(lnpayment)}) <b>succeeded</b>"
f"Payment LNPayment({lnpayment.payment_hash},{str(lnpayment)}) **succeeded**"
)

results = {"succeded": True}
Expand Down Expand Up @@ -678,7 +678,7 @@ def handle_response(response, was_in_transit=False):
order.save(update_fields=["expires_at"])

order.log(
f"Payment LNPayment({lnpayment.payment_hash},{str(lnpayment)}) <b>had expired</b>"
f"Payment LNPayment({lnpayment.payment_hash},{str(lnpayment)}) **had expired**"
)

results = {
Expand Down
76 changes: 38 additions & 38 deletions api/logics.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -324,7 +324,7 @@ def order_expires(cls, order):
send_notification.delay(order_id=order.id, message="order_expired_untaken")

order.log("Order expired while public or paused")
order.log("Maker bond was <b>unlocked</b>")
order.log("Maker bond was **unlocked**")

return True

Expand All @@ -344,8 +344,8 @@ def order_expires(cls, order):
order.log(
"Order expired while waiting for both buyer invoice and seller escrow"
)
order.log("Maker bond was <b>settled</b>")
order.log("Taker bond was <b>settled</b>")
order.log("Maker bond was **settled**")
order.log("Taker bond was **settled**")

return True

Expand All @@ -367,8 +367,8 @@ def order_expires(cls, order):
cls.add_slashed_rewards(order, order.maker_bond, order.taker_bond)

order.log("Order expired while waiting for escrow of the maker/seller")
order.log("Maker bond was <b>settled</b>")
order.log("Taker bond was <b>unlocked</b>")
order.log("Maker bond was **settled**")
order.log("Taker bond was **unlocked**")

return True

Expand All @@ -387,7 +387,7 @@ def order_expires(cls, order):
cls.add_slashed_rewards(order, taker_bond, order.maker_bond)

order.log("Order expired while waiting for escrow of the taker/seller")
order.log("Taker bond was <b>settled</b>")
order.log("Taker bond was **settled**")

return True

Expand All @@ -408,8 +408,8 @@ def order_expires(cls, order):
cls.add_slashed_rewards(order, order.maker_bond, order.taker_bond)

order.log("Order expired while waiting for invoice of the maker/buyer")
order.log("Maker bond was <b>settled</b>")
order.log("Taker bond was <b>unlocked</b>")
order.log("Maker bond was **settled**")
order.log("Taker bond was **unlocked**")

return True

Expand All @@ -424,7 +424,7 @@ def order_expires(cls, order):
cls.add_slashed_rewards(order, taker_bond, order.maker_bond)

order.log("Order expired while waiting for invoice of the taker/buyer")
order.log("Taker bond was <b>settled</b>")
order.log("Taker bond was **settled**")

return True

Expand Down Expand Up @@ -487,8 +487,8 @@ def automatic_dispute_resolution(cls, order):
cls.settle_bond(order.taker_bond)
order.update_status(Order.Status.DIS)

order.log("Maker bond was <b>settled</b>")
order.log("Taker bond was <b>settled</b>")
order.log("Maker bond was **settled**")
order.log("Taker bond was **settled**")
order.log(
"No robot wrote in the chat, the dispute cannot be solved automatically"
)
Expand All @@ -500,10 +500,10 @@ def automatic_dispute_resolution(cls, order):
order.update_status(Order.Status.MLD)
cls.add_slashed_rewards(order, order.maker_bond, order.taker_bond)

order.log("Maker bond was <b>settled</b>")
order.log("Taker bond was <b>unlocked</b>")
order.log("Maker bond was **settled**")
order.log("Taker bond was **unlocked**")
order.log(
"<b>The dispute was solved automatically:</b> 'Maker lost dispute', the maker did not write in the chat"
"**The dispute was solved automatically:** 'Maker lost dispute', the maker did not write in the chat"
)

elif num_messages_taker == 0:
Expand All @@ -513,10 +513,10 @@ def automatic_dispute_resolution(cls, order):
order.update_status(Order.Status.TLD)
cls.add_slashed_rewards(order, order.taker_bond, order.maker_bond)

order.log("Maker bond was <b>unlocked</b>")
order.log("Taker bond was <b>settled</b>")
order.log("Maker bond was **unlocked**")
order.log("Taker bond was **settled**")
order.log(
"<b>The dispute was solved automatically:</b> 'Taker lost dispute', the maker did not write in the chat"
"**The dispute was solved automatically:** 'Taker lost dispute', the maker did not write in the chat"
)
else:
return False
Expand Down Expand Up @@ -581,8 +581,8 @@ def open_dispute(cls, order, user=None):
order.log(
f"Dispute was opened {f'by Robot({user.robot.id},{user.username})' if user else ''}"
)
order.log("Maker bond was <b>settled</b>")
order.log("Taker bond was <b>settled</b>")
order.log("Maker bond was **settled**")
order.log("Taker bond was **settled**")

return True, None

Expand Down Expand Up @@ -1060,11 +1060,11 @@ def cancel_order(cls, order, user, cancel_status=None):
order.update_status(Order.Status.UCA)

order.log("Order cancelled by maker while public or paused")
order.log("Maker bond was <b>unlocked</b>")
order.log("Maker bond was **unlocked**")

take_orders_queryset = TakeOrder.objects.filter(order=order)
for idx, take_order in enumerate(take_orders_queryset):
order.log("Pretaker bond was <b>unlocked</b>")
order.log("Pretaker bond was **unlocked**")
cls.take_order_expires(take_order)

send_notification.delay(
Expand Down Expand Up @@ -1113,8 +1113,8 @@ def cancel_order(cls, order, user, cancel_status=None):
cls.add_slashed_rewards(order, order.maker_bond, order.taker_bond)

order.log("Maker cancelled before escrow was locked")
order.log("Maker bond was <b>settled</b>")
order.log("Taker bond was <b>unlocked</b>")
order.log("Maker bond was **settled**")
order.log("Taker bond was **unlocked**")

nostr_send_order_event.delay(order_id=order.id)

Expand All @@ -1137,8 +1137,8 @@ def cancel_order(cls, order, user, cancel_status=None):
cls.add_slashed_rewards(order, taker_bond, order.maker_bond)

order.log("Taker cancelled before escrow was locked")
order.log("Taker bond was <b>settled</b>")
order.log("Maker bond was <b>unlocked</b>")
order.log("Taker bond was **settled**")
order.log("Maker bond was **unlocked**")

nostr_send_order_event.delay(order_id=order.id)

Expand Down Expand Up @@ -1191,7 +1191,7 @@ def cancel_order(cls, order, user, cancel_status=None):
return True, None

order.log(
f"Cancel request was sent by Robot({user.robot.id},{user.username}) on an invalid status {order.status}: <i>{Order.Status(order.status).label}</i>"
f"Cancel request was sent by Robot({user.robot.id},{user.username}) on an invalid status {order.status}: *{Order.Status(order.status).label}*"
)
return False, new_error(1021)

Expand All @@ -1210,9 +1210,9 @@ def collaborative_cancel(cls, order):
nostr_send_order_event.delay(order_id=order.id)

order.log("Order was collaboratively cancelled")
order.log("Maker bond was <b>unlocked</b>")
order.log("Taker bond was <b>unlocked</b>")
order.log("Trade escrow was <b>unlocked</b>")
order.log("Maker bond was **unlocked**")
order.log("Taker bond was **unlocked**")
order.log("Trade escrow was **unlocked**")

return

Expand Down Expand Up @@ -1390,7 +1390,7 @@ def finalize_contract(cls, take_order):
nostr_send_order_event.delay(order_id=order.id)

order.log(
f"<b>Contract formalized.</b> Maker: Robot({order.maker.robot.id},{order.maker}). Taker: Robot({order.taker.robot.id},{order.taker}). API median price {order.currency.exchange_rate} {dict(Currency.currency_choices)[order.currency.currency]}/BTC. Premium is {order.premium}%. Contract size {order.last_satoshis} Sats"
f"**Contract formalized.** Maker: Robot({order.maker.robot.id},{order.maker}). Taker: Robot({order.taker.robot.id},{order.taker}). API median price {order.currency.exchange_rate} {dict(Currency.currency_choices)[order.currency.currency]}/BTC. Premium is {order.premium}%. Contract size {order.last_satoshis} Sats"
)
return True

Expand Down Expand Up @@ -1570,7 +1570,7 @@ def settle_escrow(order):
if LNNode.settle_hold_invoice(order.trade_escrow.preimage):
order.trade_escrow.status = LNPayment.Status.SETLED
order.trade_escrow.save(update_fields=["status"])
order.log("Trade escrow was <b>settled</b>")
order.log("Trade escrow was **settled**")
return True

def settle_bond(bond):
Expand All @@ -1585,7 +1585,7 @@ def return_escrow(order):
if LNNode.cancel_return_hold_invoice(order.trade_escrow.payment_hash):
order.trade_escrow.status = LNPayment.Status.RETNED
order.trade_escrow.save(update_fields=["status"])
order.log("Trade escrow was <b>unlocked</b>")
order.log("Trade escrow was **unlocked**")
return True

def cancel_escrow(order):
Expand All @@ -1594,7 +1594,7 @@ def cancel_escrow(order):
if LNNode.cancel_return_hold_invoice(order.trade_escrow.payment_hash):
order.trade_escrow.status = LNPayment.Status.CANCEL
order.trade_escrow.save(update_fields=["status"])
order.log("Trade escrow was <b>cancelled</b>")
order.log("Trade escrow was **cancelled**")
return True

def return_bond(bond):
Expand Down Expand Up @@ -1622,7 +1622,7 @@ def cancel_onchain_payment(order):
order.payout_tx.save(update_fields=["status"])

order.log(
f"Onchain payment OnchainPayment({order.payout_tx.id},{str(order.payout_tx)}) was <b>cancelled</b>"
f"Onchain payment OnchainPayment({order.payout_tx.id},{str(order.payout_tx)}) was **cancelled**"
)

return True
Expand Down Expand Up @@ -1662,7 +1662,7 @@ def pay_buyer(cls, order):
order.save(update_fields=["contract_finalization_time"])

send_notification.delay(order_id=order.id, message="trade_successful")
order.log("<b>Paying buyer invoice</b>")
order.log("**Paying buyer invoice**")
return True

# Pay onchain to address
Expand All @@ -1679,7 +1679,7 @@ def pay_buyer(cls, order):
order.save(update_fields=["contract_finalization_time"])

send_notification.delay(order_id=order.id, message="trade_successful")
order.log("<b>Paying buyer onchain address</b>")
order.log("**Paying buyer onchain address**")
return True

@classmethod
Expand Down Expand Up @@ -1722,8 +1722,8 @@ def confirm_fiat(cls, order, user):
# RETURN THE BONDS
cls.return_bond(order.taker_bond)
cls.return_bond(order.maker_bond)
order.log("Taker bond was <b>unlocked</b>")
order.log("Maker bond was <b>unlocked</b>")
order.log("Taker bond was **unlocked**")
order.log("Maker bond was **unlocked**")
# !!! KEY LINE - PAYS THE BUYER INVOICE !!!
cls.pay_buyer(order)

Expand Down
8 changes: 4 additions & 4 deletions api/management/commands/follow_invoices.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,7 +228,7 @@ def update_order_status(self, lnpayment):
# It is a maker bond => Publish order.
if hasattr(lnpayment, "order_made"):
self.stderr.write("Updating order with new Locked bond from maker")
lnpayment.order_made.log("Maker bond <b>locked</b>")
lnpayment.order_made.log("Maker bond **locked**")
Logics.publish_order(lnpayment.order_made)
send_notification.delay(
order_id=lnpayment.order_made.id, message="order_published"
Expand All @@ -242,15 +242,15 @@ def update_order_status(self, lnpayment):
self.stderr.write(
"Updating order with new Locked bond from taker"
)
lnpayment.take_order.order.log("Taker bond <b>locked</b>")
lnpayment.take_order.order.log("Taker bond **locked**")
Logics.finalize_contract(lnpayment.take_order)
else:
# It there was another taker already locked => cancel bond.
self.stderr.write(
"Expiring take_order because order was already taken"
)
lnpayment.take_order.order.log(
"Another taker bond is already locked, <b>Cancelling</b>"
"Another taker bond is already locked, **Cancelling**"
)
Logics.take_order_expires(lnpayment.take_order)

Expand All @@ -259,7 +259,7 @@ def update_order_status(self, lnpayment):
# It is a trade escrow => move foward order status.
elif hasattr(lnpayment, "order_escrow"):
self.stderr.write("Updating order with new Locked escrow")
lnpayment.order_escrow.log("Trade escrow <b>locked</b>")
lnpayment.order_escrow.log("Trade escrow **locked**")
Logics.trade_escrow_received(lnpayment.order_escrow)
return

Expand Down
Loading
Loading