From ddb125f45892b4dafdbd5c072af1ce623758bb92 Mon Sep 17 00:00:00 2001 From: Nicolas Dorier Date: Thu, 23 Feb 2023 00:35:34 +0900 Subject: [PATCH] Fix: HTML injection in payment request/posData/receiptData (Close #4678) (#4679) Co-authored-by: Dennis Reimann --- .../BitcoinLikeMethodCheckoutNoScript.cshtml | 2 +- .../Bitcoin/ViewBitcoinLikePaymentData.cshtml | 8 ++- BTCPayServer/Views/Shared/PosData.cshtml | 28 +++++---- BTCPayServer/Views/UIInvoice/PosData.cshtml | 60 ------------------- .../Views/UILNURL/EditLightningAddress.cshtml | 8 +-- 5 files changed, 28 insertions(+), 78 deletions(-) delete mode 100644 BTCPayServer/Views/UIInvoice/PosData.cshtml diff --git a/BTCPayServer/Views/Shared/Bitcoin/BitcoinLikeMethodCheckoutNoScript.cshtml b/BTCPayServer/Views/Shared/Bitcoin/BitcoinLikeMethodCheckoutNoScript.cshtml index a374d5cd36..abea189805 100644 --- a/BTCPayServer/Views/Shared/Bitcoin/BitcoinLikeMethodCheckoutNoScript.cshtml +++ b/BTCPayServer/Views/Shared/Bitcoin/BitcoinLikeMethodCheckoutNoScript.cshtml @@ -1,6 +1,6 @@ @model PaymentModel
-

To complete payment, please send @Safe.Raw(Model.IsUnsetTopUp? "any amount of": Model.BtcDue) @Model.CryptoCode to @Model.BtcAddress

+

To complete payment, please send @(Model.IsUnsetTopUp ? "any amount of" : Model.BtcDue) @Model.CryptoCode to @Model.BtcAddress

Time remaining: @Model.TimeLeft

@Model.InvoiceBitcoinUrl diff --git a/BTCPayServer/Views/Shared/Bitcoin/ViewBitcoinLikePaymentData.cshtml b/BTCPayServer/Views/Shared/Bitcoin/ViewBitcoinLikePaymentData.cshtml index 59b1a7b865..3a7f2ff6d7 100644 --- a/BTCPayServer/Views/Shared/Bitcoin/ViewBitcoinLikePaymentData.cshtml +++ b/BTCPayServer/Views/Shared/Bitcoin/ViewBitcoinLikePaymentData.cshtml @@ -77,7 +77,13 @@ @payment.Crypto @(payment.CryptoPaymentData.KeyPath?.ToString()?? "Unknown") @payment.DepositAddress - @payment.CryptoPaymentData.GetValue() @Safe.Raw(payment.AdditionalInformation is string i ? $"
({i})" : string.Empty) + + @payment.CryptoPaymentData.GetValue() + @if (!string.IsNullOrEmpty(payment.AdditionalInformation)) + { +

(@payment.AdditionalInformation)
+ } + @if (hasNetworkFee) { @payment.NetworkFee diff --git a/BTCPayServer/Views/Shared/PosData.cshtml b/BTCPayServer/Views/Shared/PosData.cshtml index 14c84f3bff..b57385823e 100644 --- a/BTCPayServer/Views/Shared/PosData.cshtml +++ b/BTCPayServer/Views/Shared/PosData.cshtml @@ -16,16 +16,16 @@ { if (!string.IsNullOrEmpty(key)) { - @Safe.Raw(key) + @key } @if (IsValidURL(str)) { - @Safe.Raw(str) + @str } else { - @Safe.Raw(value?.ToString()) + @value?.ToString() } } @@ -34,22 +34,26 @@ @* This is the array case *@ if (subItems.Count == 1 && subItems.First().Value is string str2) { - @Safe.Raw(key) + @key @if (IsValidURL(str2)) { - @Safe.Raw(str2) + @str2 } else { - @Safe.Raw(subItems.First().Value?.ToString()) + @subItems.First().Value?.ToString() } - - } - else - { - - @Safe.Raw($"{key}") + + } + else + { + + @{ + Write(Html.Raw($"")); + Write(key); + Write(Html.Raw($"")); + } } diff --git a/BTCPayServer/Views/UIInvoice/PosData.cshtml b/BTCPayServer/Views/UIInvoice/PosData.cshtml deleted file mode 100644 index 14c84f3bff..0000000000 --- a/BTCPayServer/Views/UIInvoice/PosData.cshtml +++ /dev/null @@ -1,60 +0,0 @@ -@model (Dictionary Items, int Level) - -@functions { - private bool IsValidURL(string source) - { - return Uri.TryCreate(source, UriKind.Absolute, out var uriResult) && - (uriResult.Scheme == Uri.UriSchemeHttp || uriResult.Scheme == Uri.UriSchemeHttps); - } -} - - - @foreach (var (key, value) in Model.Items) - { - - @if (value is string str) - { - if (!string.IsNullOrEmpty(key)) - { - - } - - } - else if (value is DictionarysubItems) - { - @* This is the array case *@ - if (subItems.Count == 1 && subItems.First().Value is string str2) - { - - - } - else - { - - } - } - - } -
@Safe.Raw(key) - @if (IsValidURL(str)) - { - @Safe.Raw(str) - } - else - { - @Safe.Raw(value?.ToString()) - } - @Safe.Raw(key) - @if (IsValidURL(str2)) - { - @Safe.Raw(str2) - } - else - { - @Safe.Raw(subItems.First().Value?.ToString()) - } - - @Safe.Raw($"{key}") - -
- diff --git a/BTCPayServer/Views/UILNURL/EditLightningAddress.cshtml b/BTCPayServer/Views/UILNURL/EditLightningAddress.cshtml index daa0d5b874..4070dfa746 100644 --- a/BTCPayServer/Views/UILNURL/EditLightningAddress.cshtml +++ b/BTCPayServer/Views/UILNURL/EditLightningAddress.cshtml @@ -69,7 +69,7 @@
- +
@@ -126,15 +126,15 @@ @if (Model.Items[index].Min.HasValue) { - @Safe.Raw($"{Model.Items[index].Min} min sats") + @Model.Items[index].Min min sats } @if (Model.Items[index].Max.HasValue) { - @Safe.Raw($"{Model.Items[index].Max} max sats") + @Model.Items[index].Max max sats } @if (!string.IsNullOrEmpty(Model.Items[index].CurrencyCode)) { - @Safe.Raw($"tracked in {Model.Items[index].CurrencyCode}") + tracked in @Model.Items[index].CurrencyCode }