| Package | Affected versions | Patched versions |
|---|---|---|
| gogs.io/gogs | < 0.14.3all versions | 0.14.3 |
The Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary data: URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endpoint uses bluemonday.UGCPolicy() with p.AllowURLSchemes("data") which permits all data URI schemes including data:text/html, enabling attackers to inject malicious HTML/JavaScript. Additionally, the endpoint has no authentication middleware, allowing any registered user to exploit this vulnerability.
High
All versions using the vulnerable endpoint
POST /-/api/sanitize_ipynbAn attacker with a registered user account can:
data:text/html URIs to the sanitization endpointThe vulnerability has higher severity because:
internal/markup/sanitizer.go:39 which uses isSafeDataURI to only allow safe image MIME types, this endpoint allows ALL data URIs including HTMLAttacker sends a POST request to the sanitization endpoint:
POST /-/api/sanitize_ipynb HTTP/1.1
Host: target.gogs.instance
Content-Type: text/plain
<a href="data:text/html,<script>alert(document.cookie)</script>">click</a>
The server returns the sanitized HTML with the data URI preserved:
<a href="data:text/html,<script>alert(document.cookie)</script>">click</a>
When this HTML is rendered in a browser, the JavaScript within the data URI will execute, leading to XSS.
File:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeinternal/app/api.go:10-16func ipynbSanitizer() *bluemonday.Policy {
p := bluemonday.UGCPolicy()
p.AllowAttrs("class", "data-prompt-number").OnElements("div")
p.AllowAttrs("class").OnElements("img")
p.AllowURLSchemes("data") // <-- VULNERABLE: allows all data URIs
return p
}
File: cmd/gogs/web.go:681-683 - No authentication middleware
m.Group("/-", func() {
m.Get("/metrics", app.MetricsFilter(), promhttp.Handler())
m.Group("/api", func() {
m.Post("/sanitize_ipynb", app.SanitizeIpynb()) // <-- No auth middleware
})
})
Unrestricted data URI scheme: The code at internal/app/api.go:14 uses p.AllowURLSchemes("data") without any restriction, unlike the safer implementation in internal/markup/sanitizer.go:39 which uses AllowURLSchemeWithCustomPolicy("data", isSafeDataURI) to only allow safe image MIME types.
No authentication: The endpoint at cmd/gogs/web.go:682 does not have any authentication middleware applied, making it accessible to any registered user.
Insufficient validation: The sanitization only removes dangerous tags/attributes but preserves data URIs, allowing data:text/html payloads to pass through.
Option 1: Use the same safe pattern as internal/markup/sanitizer.go
Replace p.AllowURLSchemes("data") with:
p.AllowURLSchemeWithCustomPolicy("data", isSafeDataURI)
Where isSafeDataURI is a function that only allows safe image MIME types (image/png, image/jpeg, image/gif, etc.).
Option 2: Add authentication middleware
Apply appropriate authentication to the endpoint:
m.Post("/sanitize_ipynb", middleware.signIn, app.SanitizeIpynb())
Option 3: Disable data URI scheme entirely
If data URIs are not required for ipynb sanitization:
// Remove this line entirely:
// p.AllowURLSchemes("data")