GHSL-2021-1018

jupyter · Aug 9, 2022 · 4b9c5e7 · 4b9c5e7
1 parent 14185eb
commit 4b9c5e7
Show file tree

Hide file tree

Showing 4 changed files with 24 additions and 4 deletions.
diff --git a/nbconvert/exporters/tests/files/notebook_inject.ipynb b/nbconvert/exporters/tests/files/notebook_inject.ipynb
@@ -25,7 +25,24 @@
     "source": [
       "<script>alert('markdown cell')</script>"
     ]
-  }
+  },
+  {
+    "cell_type": "code",
+    "execution_count": null,
+    "id": "b72e53fa",
+    "metadata": {},
+    "outputs": [
+     {
+      "output_type": "execute_result",
+      "data": {
+        "image/svg+xml": ["<script>alert('image/svg+xml output')</script>"]
+      },
+      "execution_count": null,
+      "metadata": {}
+     }
+    ],
+    "source": [""]
+   }
  ],
  "metadata": {
   "title": "TITLE</title><script>alert('title')</script>",
@@ -47,7 +64,7 @@
    "version": "3.10.5"
   },
   "widgets": {
-    "application/vnd.jupyter.widget-state+json": {"foo": "pwntester</script><script>alert('widgets');//"}
+    "application/vnd.jupyter.widget-state+json": {"state": "{}", "foo": "pwntester</script><script>alert('widgets');//"}
   }
  },
  "nbformat": 4,

diff --git a/nbconvert/exporters/tests/test_html.py b/nbconvert/exporters/tests/test_html.py
@@ -151,3 +151,6 @@ def test_javascript_injection(self):
             # Check injection in the cell.source of the Notebook
             assert "<script>alert('raw cell')</script>" not in output
             assert "<script>alert('markdown cell')</script>" not in output
+
+            # Check injection in svg output
+            assert "<script>alert('image/svg+xml output')</script>" not in output
diff --git a/share/jupyter/nbconvert/templates/classic/base.html.j2 b/share/jupyter/nbconvert/templates/classic/base.html.j2
@@ -126,7 +126,7 @@ unknown type  {{ cell.type }}
 {%- if output.svg_filename %}
 <img src="{{ output.svg_filename | posix_path }}">
 {%- else %}
-{{ output.data['image/svg+xml'] }}
+{{ output.data['image/svg+xml'] | clean_html }}
 {%- endif %}
 </div>
 {%- endblock data_svg %}

diff --git a/share/jupyter/nbconvert/templates/lab/base.html.j2 b/share/jupyter/nbconvert/templates/lab/base.html.j2
@@ -154,7 +154,7 @@ unknown type  {{ cell.type }}
 {%- if output.svg_filename %}
 <img src="{{ output.svg_filename | posix_path }}">
 {%- else %}
-{{ output.data['image/svg+xml'] }}
+{{ output.data['image/svg+xml'] | clean_html }}
 {%- endif %}
 </div>
 {%- endblock data_svg %}