Content is not escaped before inserting into DOM

[joevennix]

Reproduce:

1. Save a password with the username <script>alert(Object.keys(this))</script>.

Results:

Click to view the password you just saved, you'll get a popup containing:

top,window,location,nwDispatcher,document,global,process,Buffer,root,require,Zepto,app,$,_,Backbone,BackStack,moment,semver,FastClick,deviceIsAndroid,deviceIsIOS,deviceIsIOS4,deviceIsIOSWithBadTarget,deviceIsBlackBerry10,Offline,crypton,sjcl,io,async,dcodeIO,isomerize,jsondiffpatch,superagent,WEB_SOCKET_DISABLE_AUTO_INITIALIZATION,BigInteger,SRPClient,XMLHttpRequest,Encryptr,cordova,tmpl,_zid,clipboard

Unfortunately this script has the full power of node. This is the downside of privileged script in the DOM :(

<script>require('child_process').spawn('touch', ['/tmp/owned'])</script> etc

[joevennix]

If node-webkit supports it, you might look into adding the Content-Security-Policy meta tag to your templates to prevent inline script from running.

[devgeeks]

Funny you should mention that. The 1.2.0 version of the app has CSP. It at least pukes an error if that is attempted.

There seems to be a problem with iOS and CSP. It might be a Cordova issue. I'll make sure that's sorted out before I release iOS.

edit: It turns out the CSP just hasn't been merged into the iOS branch. It should be fine by the time it's released.

[joevennix]

Ah, now I see you have the meta tag on master: https://github.com/devgeeks/Encryptr/blob/master/www/index.html#L12 I was using 1.1.0 from the website.

That CSP policy seems excessively lax though, you can load any https:// URL. So you can still inject a script with a src of any https:// link...

[kenmanheimer]

Problem with this in desktop browser - in permissive Chrome or plain Firefox:

• In a new or existing account, create a new General entry
• Name the entry abc"def and save it
• Visit the new entry and edit it
• When I arrive in edit mode, the name has been truncated at the " to abc
• This problem happens reliably, in both the general entry's Name and Text fields, but not in the Notes field.

[kenmanheimer]

(Sorry, my last comment belonged in the PR, not this issue.)