CVE-2013-0256: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2013-03-01T05:40Z
Repository: https://github.com/rdoc/rdoc
Language: Other
Files changed: CVE-2013-0256.rdoc, History.rdoc, Manifest.txt, Rakefile, lib/rdoc.rb, lib/rdoc/generator/template/darkfish/js/darkfish.js
Commit date: 2013-02-05 19:57:58 -0800
Commit message: Fix CVE-2013-0256, an XSS exploit in RDoc

See CVE-2013-0256 for details on the exploit including a patch you can
apply to generated RDoc output.

Diff: diff --git a/CVE-2013-0256.rdoc b/CVE-2013-0256.rdoc
new file mode 100644
index 0000000..b285b6a
--- /dev/null
+++ b/CVE-2013-0256.rdoc
@@ -0,0 +1,49 @@
+= RDoc 2.3.0 through 3.12 XSS Exploit
+
+RDoc documentation generated by rdoc 2.3.0 through rdoc 3.12 and prereleases up
+to rdoc 4.0.0.preview2.1 are vulnerable to an XSS exploit.  This exploit may
+lead to cookie disclosure to third parties.
+
+The exploit exists in darkfish.js which is copied from the RDoc install
+location to the generated documentation.
+
+RDoc is a static documentation generation tool.  Patching the library itself
+is insufficient to correct this exploit.  Those hosting rdoc documentation will
+need to apply the following patch.  If applied while ignoring whitespace, this
+patch will correct all affected versions:
+
+  diff --git darkfish.js darkfish.js
+  index 4be722f..f26fd45 100644
+  --- darkfish.js
+  +++ darkfish.js
+  @@ -109,13 +109,15 @@ function hookSearch() {
+   function highlightTarget( anchor ) {
+     console.debug( "Highlighting target '%s'.", anchor );
+   
+  -  $("a[name=" + anchor + "]").each( function() {
+  -    if ( !$(this).parent().parent().hasClass('target-section') ) {
+  -      console.debug( "Wrapping the target-section" );
+  -      $('div.method-detail').unwrap( 'div.target-section' );
+  -      $(this).parent().wrap( '<div class="target-section"></div>' );
+  -    } else {
+  -      console.debug( "Already wrapped." );
+  +  $("a[name]").each( function() {
+  +    if ( $(this).attr("name") == anchor ) {
+  +      if ( !$(this).parent().parent().hasClass('target-section') ) {
+  +        console.debug( "Wrapping the target-section" );
+  +        $('div.method-detail').unwrap( 'div.target-section' );
+  +        $(this).parent().wrap( '<div class="target-section"></div>' );
+  +      } else {
+  +        console.debug( "Already wrapped." );
+  +      }
+       }
+     });
+   };
+
+RDoc 3.9.5, 3.12.1 and RDoc 4.0.0.rc.2 and newer are not vulnerable to this
+exploit.
+
+This exploit was discovered by Evgeny Ermakov <corwmh@gmail.com>.
+
+This vulnerability has been assigned the CVE identifier CVE-2013-0256.
+
diff --git a/History.rdoc b/History.rdoc
index 21497df..f4ebf1f 100644
--- a/History.rdoc
+++ b/History.rdoc
@@ -1,6 +1,6 @@
-=== 4.0.0.preview3.1 / ??
+=== 4.0.0.rc.2 / ??
 
 As a preview release, please file bugs for any problems you have with rdoc at
 https://github.com/rdoc/rdoc/issues
 
 RDoc 4.0 includes several new features and several breaking changes.  The
@@ -12,10 +12,13 @@ to build HTML documentation when installing gems.)
 
 * Minor enhancements
   * Added current heading and page-top links to HTML headings.
 
 * Bug fixes
+  * Fixed an XSS exploit in darkfish.js.  This could lead to cookie disclosure
+    to third parties.  See CVE-2012-0256.rdoc for full details including a
+    patch you can apply to generated RDoc documentation.
   * Fixed parsing of multibyte files with incomplete characters at byte 1024.
     Ruby bug #6393 by nobu, patch by Nobuyoshi Nakada and Yui NARUSE.
   * Fixed rdoc -E.  Ruby Bug #6392 and (modified) patch by Nobuyoshi Nakada
   * Added link handling to Markdown output.  Bug #160 by burningTyger.
   * Fixed HEREDOC output for the limited case of a heredoc followed by a line
diff --git a/Manifest.txt b/Manifest.txt
index 918447a..b26bfef 100644
--- a/Manifest.txt
+++ b/Manifest.txt
@@ -1,7 +1,8 @@
 .autotest
 .document
+CVE-2013-0256.rdoc
 DEVELOPERS.rdoc
 History.rdoc
 LEGAL.rdoc
 LICENSE.rdoc
 Manifest.txt
diff --git a/Rakefile b/Rakefile
index 3985102..962c473 100644
--- a/Rakefile
+++ b/Rakefile
@@ -46,10 +46,11 @@ Depending on your version of ruby, you may need to install ruby rdoc/ri data:
   self.readme_file  = 'README.rdoc'
   self.history_file = 'History.rdoc'
   self.testlib = :minitest
   self.extra_rdoc_files += %w[
     DEVELOPERS.rdoc
+    CVE-2013-0256.rdoc
     History.rdoc
     LICENSE.rdoc
     LEGAL.rdoc
     README.rdoc
     RI.rdoc
diff --git a/lib/rdoc.rb b/lib/rdoc.rb
index 2cac8be..1b53421 100644
--- a/lib/rdoc.rb
+++ b/lib/rdoc.rb
@@ -62,11 +62,11 @@ module RDoc
   class Error < RuntimeError; end
 
   ##
   # RDoc version you are using
 
-  VERSION = '4.0.0.preview3.1'
+  VERSION = '4.0.0.rc.2'
 
   ##
   # Method visibilities
 
   VISIBILITIES = [:public, :protected, :private]
diff --git a/lib/rdoc/generator/template/darkfish/js/darkfish.js b/lib/rdoc/generator/template/darkfish/js/darkfish.js
index 4be722f..f26fd45 100644
--- a/lib/rdoc/generator/template/darkfish/js/darkfish.js
+++ b/lib/rdoc/generator/template/darkfish/js/darkfish.js
@@ -107,17 +107,19 @@ function hookSearch() {
 };
 
 function highlightTarget( anchor ) {
   console.debug( "Highlighting target '%s'.", anchor );
 
-  $("a[name=" + anchor + "]").each( function() {
-    if ( !$(this).parent().parent().hasClass('target-section') ) {
-      console.debug( "Wrapping the target-section" );
-      $('div.method-detail').unwrap( 'div.target-section' );
-      $(this).parent().wrap( '<div class="target-section"></div>' );
-    } else {
-      console.debug( "Already wrapped." );
+  $("a[name]").each( function() {
+    if ( $(this).attr("name") == anchor ) {
+      if ( !$(this).parent().parent().hasClass('target-section') ) {
+        console.debug( "Wrapping the target-section" );
+        $('div.method-detail').unwrap( 'div.target-section' );
+        $(this).parent().wrap( '<div class="target-section"></div>' );
+      } else {
+        console.debug( "Already wrapped." );
+      }
     }
   });
 };
 
 function highlightLocationTarget() {

Vulnerable code: === 4.0.0.preview3.1 / ??
  VERSION = '4.0.0.preview3.1'
  $("a[name=" + anchor + "]").each( function() {
    if ( !$(this).parent().parent().hasClass('target-section') ) {
      console.debug( "Wrapping the target-section" );
      $('div.method-detail').unwrap( 'div.target-section' );
      $(this).parent().wrap( '<div class="target-section"></div>' );
    } else {
      console.debug( "Already wrapped." );
Fixed code: = RDoc 2.3.0 through 3.12 XSS Exploit

RDoc documentation generated by rdoc 2.3.0 through rdoc 3.12 and prereleases up
to rdoc 4.0.0.preview2.1 are vulnerable to an XSS exploit.  This exploit may
lead to cookie disclosure to third parties.

The exploit exists in darkfish.js which is copied from the RDoc install
location to the generated documentation.

RDoc is a static documentation generation tool.  Patching the library itself
is insufficient to correct this exploit.  Those hosting rdoc documentation will
need to apply the following patch.  If applied while ignoring whitespace, this
patch will correct all affected versions:

  diff --git darkfish.js darkfish.js
  index 4be722f..f26fd45 100644
  --- darkfish.js
  +++ darkfish.js
  @@ -109,13 +109,15 @@ function hookSearch() {
   function highlightTarget( anchor ) {
     console.debug( "Highlighting target '%s'.", anchor );
   
  -  $("a[name=" + anchor + "]").each( function() {
  -    if ( !$(this).parent().parent().hasClass('target-section') ) {
  -      console.debug( "Wrapping the target-section" );
  -      $('div.method-detail').unwrap( 'div.target-section' );
  -      $(this).parent().wrap( '<div class="target-section"></div>' );
  -    } else {
  -      console.debug( "Already wrapped." );
  +  $("a[name]").each( function() {
  +    if ( $(this).attr("name") == anchor ) {
  +      if ( !$(this).parent().parent().hasClass('target-section') ) {
  +        console.debug( "Wrapping the target-section" );
  +        $('div.method-detail').unwrap( 'div.target-section' );
  +        $(this).parent().wrap( '<div class="target-section"></div>' );
  +      } else {
  +        console.debug( "Already wrapped." );
  +      }
       }
     });
   };

RDoc 3.9.5, 3.12.1 and RDoc 4.0.0.rc.2 and newer are not vulnerable to this
exploit.

This exploit was discovered by Evgeny Ermakov <corwmh@gmail.com>.

This vulnerability has been assigned the CVE identifier CVE-2013-0256.

=== 4.0.0.rc.2 / ??
  * Fixed an XSS exploit in darkfish.js.  This could lead to cookie disclosure
    to third parties.  See CVE-2012-0256.rdoc for full details including a
    patch you can apply to generated RDoc documentation.
CVE-2013-0256.rdoc
    CVE-2013-0256.rdoc
  VERSION = '4.0.0.rc.2'
  $("a[name]").each( function() {
    if ( $(this).attr("name") == anchor ) {
      if ( !$(this).parent().parent().hasClass('target-section') ) {
        console.debug( "Wrapping the target-section" );
        $('div.method-detail').unwrap( 'div.target-section' );
        $(this).parent().wrap( '<div class="target-section"></div>' );
      } else {
        console.debug( "Already wrapped." );
      }