CVE-2024-35234: Insufficient Information (NVD-CWE-noinfo)
value: Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, an attacker can execute arbitrary JavaScript on users’ browsers by posting a specific URL containing maliciously crafted meta tags. This issue only affects sites with Content Security Polic (CSP) disabled. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. As a workaround, ensure CSP is enabled on the forum.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-03T19:15Z
Repository: https://github.com/discourse/discourse
Language: Ruby
Files changed: lib/onebox/engine/facebook_media_onebox.rb, spec/lib/onebox/engine/facebook_media_onebox_spec.rb
Commit date: 2024-07-03 20:49:22 +0800
Commit message: SECURITY: Fix Stored-dom XSS via Facebook Oneboxes

Diff: diff --git a/lib/onebox/engine/facebook_media_onebox.rb b/lib/onebox/engine/facebook_media_onebox.rb
index 9e676e185584b..003adb6182ed9 100644
--- a/lib/onebox/engine/facebook_media_onebox.rb
+++ b/lib/onebox/engine/facebook_media_onebox.rb
@@ -4,11 +4,11 @@ module Onebox
   module Engine
     class FacebookMediaOnebox
       include Engine
       include StandardEmbed
 
-      matches_regexp(%r{^https?://.*\.facebook\.com/(\w+)/(videos|\?).*})
+      matches_regexp(%r{^https?://(?:www\.)?facebook\.com/(\w+)/(videos|\?).*})
       always_https
       requires_iframe_origins "https://www.facebook.com"
 
       def to_html
         metadata = get_twitter
diff --git a/spec/lib/onebox/engine/facebook_media_onebox_spec.rb b/spec/lib/onebox/engine/facebook_media_onebox_spec.rb
new file mode 100644
index 0000000000000..aa58eee88db5e
--- /dev/null
+++ b/spec/lib/onebox/engine/facebook_media_onebox_spec.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+RSpec.describe Onebox::Engine::FacebookMediaOnebox do
+  describe "regex URI match" do
+    it "matches videos with title" do
+      expect(match("https://www.facebook.com/user/videos/title/123456789/")).to eq true
+    end
+
+    it "matches videos without a title" do
+      expect(match("https://facebook.com/user/videos/123456789")).to eq true
+    end
+
+    it "only matches the facebook.com domain" do
+      expect(match("https://somedomain.com/a.facebook.com/a/videos")).to eq false
+    end
+
+    def match(url)
+      Onebox::Engine::FacebookMediaOnebox === URI(url)
+    end
+  end
+end

Vulnerable code:       matches_regexp(%r{^https?://.*\.facebook\.com/(\w+)/(videos|\?).*})
Fixed code:       matches_regexp(%r{^https?://(?:www\.)?facebook\.com/(\w+)/(videos|\?).*})
# frozen_string_literal: true

RSpec.describe Onebox::Engine::FacebookMediaOnebox do
  describe "regex URI match" do
    it "matches videos with title" do
      expect(match("https://www.facebook.com/user/videos/title/123456789/")).to eq true
    end

    it "matches videos without a title" do
      expect(match("https://facebook.com/user/videos/123456789")).to eq true
    end

    it "only matches the facebook.com domain" do
      expect(match("https://somedomain.com/a.facebook.com/a/videos")).to eq false
    end

    def match(url)
      Onebox::Engine::FacebookMediaOnebox === URI(url)
    end
  end
end