Markdown filter "safe" mode is vulnerable to e.g. 'onclick' attributes

[Fletcher Tomalty]

The Python markdown library used by Django has syntax like this, which is obviously a JS injection vulnerability:

{@onclick=alert(1)}paragraph

Somehow, Python-markdown's safe mode still allows this, and thus, Django does too. Since this "safe" mode is what developers are expected to use to render user input, this is a pretty significant security issue.

I have opened a ticket for Python-markdown here: ​https://github.com/waylan/Python-Markdown/issues/82

Newer versions of Python-markdown have an "enable_attributes" argument that you can pass, while older versions have a constant "ENABLE_ATTRIBUTES" that is declared at the module level. I'm not sure what the best way to fix this in Django directly would be.

[Carl Meyer]

Thanks for the report. In future, please send security-related bugs to security@… rather than filing them in Trac (the Trac new-ticket form makes this same request right above the form.)

[Fletcher Tomalty]

Sorry, that was stupid of me. I should have done so, but it slipped my mind because this vulnerability is already public for the Python-Markdown library itself.

[Yuval Adam]

python-markdown has decided not to fix this (see github issue).

I'm not sure this falls in Django's scope. (Do we want to start white/blacklisting attrs?)

The question might be whether we want to use some third-party app here to assist in cleaning the markdown attrs.

[Adrien Lemaire]

At least the Django doc warns the users about that in ​https://docs.djangoproject.com/en/dev/ref/contrib/markup/:

Warning
The output of markup filters is marked “safe” and will not be escaped when rendered in a template. Always be careful to sanitize your inputs and make sure you are not leaving yourself vulnerable to cross-site scripting or other types of attacks.

We could complete this doc by referring some 3rd-part apps such as bleach maybe ?
This shouldn't be a release blocker anymore.

[Preston Holmes]

patch for trunk

[Preston Holmes]

for 1.3.X branch

[Preston Holmes]

After some discussion with Paul at the sprints, we decided to deprecate Python-Markdown<2.1

The "safe" arg to the filter in the patches just attached enables both the safe_mode=True and enable_attributes=False in tandem

[Preston Holmes]

Updating to trunk

[Paul McMillan]

In [17734]:

[1.3.X] Fixed #17837. Improved markdown safety.

Markdown enable_attributes is now False when safe_mode is enabled. Documented
the markdown "safe" argument. Added warnings when the safe argument is
passed to versions of markdown which cannot be made safe.

[Paul McMillan]

In [17735]:

Fixed #17837. Improved markdown safety.

Markdown enable_attributes is now False when safe_mode is enabled. Documented
the markdown "safe" argument. Added warnings when the safe argument is
passed to versions of markdown which cannot be made safe. Deprecated
versions of markdown < 2.1. Many thanks to ptone for the patch.