XSS via filename

[ivan]

serve-index directory listings are vulnerable to XSS via arbitrary uploader-controlled filenames.

Repro steps:

1. Run https://github.com/expressjs/serve-index#serve-directory-indexes-with-vanilla-nodejs-http-server
2. cd public/ftp
3. touch '<img src="" onerror="alert(0)">'
4. Load the serve-index server in Chrome 41, see an alert box

I spotted this when testing webpack-dev-server, which is also vulnerable as it uses serve-index.

[dougwilson]

Thanks for the report. I'm going to publish a fix ASAP right now. P.S. if you like, always feel free to email me directly for security issues :) You can always post publicly on the repo if the author (me in this case) does not seem to be responding in a reasonable amount of time :D

[ivan]

Sorry, I'll do that in the future! I looked at http://expressjs.com/ for a security contact, but I should have just tried your email.

[dougwilson]

No problem. We are working on a policy. I was mainly just talking in general :)

[dougwilson]

Oh, I see, it's the title attribute. Doh!

[dougwilson]

...and the content, lol. Basically, only the href seems to be escaped... this is terrible :'(

[dougwilson]

Please feel free to confirm this fix :)

[ivan]

Thanks, that seems to have fixed the one I reported.

I found another, though: the directory/path indicator at the top of the index page needs escaping as well. Try an mkdir '<img src="" onerror="alert(0)">' and navigate to that directory.

[dougwilson]

Awesome!! Fixing...

[ivan]

Also, in the title tag.

[dougwilson]

Ok, I think I may have gotten them all now.

[dougwilson]

@andrewrk I'm pinging you because of the last serve-static back-port. Do you need this fix back-ported to some older minor line?

[andrewrk]

I'm ok, thanks. I'd like the option to ask for it later if I have to deal with another bug report asking for the patch earlier, if that's OK.

[dougwilson]

I'd like the option to ask for it later

The option is always available :) I was just checking ahead of time just in case you happened to know :)

[dougwilson]

This has been published to npm as 1.6.3.