app-backend: escape script tag endings in config

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
2024-09-17 13:11:13 +02:00
parent 05e0b20916
commit 8d472c89e1
2 changed files with 37 additions and 1 deletions
@@ -67,6 +67,35 @@ describe('injectConfigIntoHtml', () => {
  }
 ]
 </script>
+</head></html>`,
+    });
+  });
+
+  it('should trim script tag endings from injected config', async () => {
+    mockDir.setContent({
+      'index.html.tmpl': '<html><head></head></html>',
+    });
+    await injectConfigIntoHtml({
+      ...baseOptions,
+      appConfigs: [
+        {
+          context: 'mock',
+          data: { x: "</script><script>alert('hi')</script><!-- Hi -->" },
+        },
+      ],
+    });
+    expect(mockDir.content()).toMatchObject({
+      'index.html': `<html><head>
+<script type="backstage.io/config">
+[
+  {
+    "context": "mock",
+    "data": {
+      "x": "><script>alert('hi')> Hi -->"
+    }
+  }
+]
+</script>
 </head></html>`,
    });
  });
@@ -55,7 +55,14 @@ export async function injectConfigIntoHtml(
    '</head>',
    `
 <script type="backstage.io/config">
-${JSON.stringify(appConfigs, null, 2)}
+${JSON.stringify(appConfigs, null, 2)
+  // Note on the security aspects of this: We generally trust the app config to
+  // be safe, since control of the app config effectively means full control of
+  // the app. These substitutions are here as an extra precaution to avoid
+  // unintentionally breaking the app, to avoid this being flagged, and in case
+  // someone decides to hook up user input to the app config in their own setup.
+  .replaceAll('</script', '')
+  .replaceAll('<!--', '')}
 </script>
 </head>`,
  );