CVE-2024-29882 (C++, published 2024-03-28T14:15Z)
Description: value: SRS is a simple, high-efficiency, real-time video server. SRS's `/api/v1/vhosts/vid-<id>?callback=<payload>` endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS ( Cross-Site Scripting). This vulnerability is fixed in 5.0.210 and 6.0.121.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/ossrs/srs
Files changed:
trunk/configure
trunk/doc/CHANGELOG.md
trunk/src/core/srs_core_version5.hpp
trunk/src/core/srs_core_version6.hpp
trunk/src/kernel/srs_kernel_error.hpp
trunk/src/protocol/srs_protocol_http_conn.cpp
trunk/src/utest/srs_utest_protocol3.cpp
trunk/src/utest/srs_utest_protocol3.hpp
Commit message: Merge pull request from GHSA-gv9r-qcjc-5hj7

* Filter JSONP callback function name. v5.0.210,v6.0.121

* Add utest.

* Refine utest

Vulnerable code:
        "srs_utest_protocol" "srs_utest_protocol2" "srs_utest_kernel2")
#define VERSION_REVISION    209
#define VERSION_REVISION    120
    XX(ERROR_STREAM_CASTER_HEVC_FORMAT     , 4057, "CasterTsHevcFormat", "Invalid ts HEVC Format for stream caster")
        if (!query_get("callback").empty()) {
            jsonp = true;
        }

Fixed code:
        "srs_utest_protocol" "srs_utest_protocol2" "srs_utest_kernel2" "srs_utest_protocol3")
* v6.0, 2024-03-26, Filter JSONP callback function name. v6.0.121
* v5.0, 2024-03-26, Filter JSONP callback function name. v5.0.210
#define VERSION_REVISION    210
#define VERSION_REVISION    121
    XX(ERROR_STREAM_CASTER_HEVC_FORMAT     , 4057, "CasterTsHevcFormat", "Invalid ts HEVC Format for stream caster") \
    XX(ERROR_HTTP_JSONP                    , 4058, "HttpJsonp", "Invalid callback for JSONP")
// For callback function name, only allow [a-zA-Z0-9_-.] characters.
bool srs_is_valid_jsonp_callback(std::string callback)
{
    for (int i = 0; i < (int)callback.length(); i++) {
        char ch = callback.at(i);
        bool is_alpha_beta = (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z');
        bool is_number = (ch >= '0' && ch <= '9');
        if (!is_alpha_beta && !is_number && ch != '.' && ch != '_' && ch != '-') {
            return false;
        }
    }
    return true;
}

        string callback= query_get("callback");
        jsonp = !callback.empty();


        if (!srs_is_valid_jsonp_callback(callback)) {
            return srs_error_new(ERROR_HTTP_JSONP, "invalid callback=%s", callback.c_str());
        }
//
// Copyright (c) 2013-2024 The SRS Authors
//
// SPDX-License-Identifier: MIT
//
#include <srs_utest_protocol3.hpp>

using namespace std;

#include <srs_kernel_error.hpp>
#include <srs_core_autofree.hpp>
#include <srs_protocol_utility.hpp>
#include <srs_protocol_rtmp_msg_array.hpp>
#include <srs_protocol_rtmp_stack.hpp>
#include <srs_kernel_utility.hpp>
#include <srs_app_st.hpp>
#include <srs_protocol_amf0.hpp>
#include <srs_protocol_rtmp_stack.hpp>
#include <srs_protocol_http_conn.hpp>
#include <srs_protocol_protobuf.hpp>
#include <srs_kernel_buffer.hpp>

extern bool srs_is_valid_jsonp_callback(std::string callback);

VOID TEST(ProtocolHttpTest, JsonpCallbackName)
{
    EXPECT_TRUE(srs_is_valid_jsonp_callback(""));
    EXPECT_TRUE(srs_is_valid_jsonp_callback("callback"));
    EXPECT_TRUE(srs_is_valid_jsonp_callback("Callback"));
    EXPECT_TRUE(srs_is_valid_jsonp_callback("Callback1234567890"));
    EXPECT_TRUE(srs_is_valid_jsonp_callback("Callback-1234567890"));
    EXPECT_TRUE(srs_is_valid_jsonp_callback("Callback_1234567890"));
    EXPECT_TRUE(srs_is_valid_jsonp_callback("Callback.1234567890"));
    EXPECT_TRUE(srs_is_valid_jsonp_callback("Callback1234567890-_."));
    EXPECT_FALSE(srs_is_valid_jsonp_callback("callback()//"));
    EXPECT_FALSE(srs_is_valid_jsonp_callback("callback!"));
    EXPECT_FALSE(srs_is_valid_jsonp_callback("callback;"));
}

//
// Copyright (c) 2013-2024 The SRS Authors
//
// SPDX-License-Identifier: MIT
//

#ifndef SRS_UTEST_PROTOCOL3_HPP
#define SRS_UTEST_PROTOCOL3_HPP

/*
#include <srs_utest_protocol3.hpp>
*/
#include <srs_utest_protocol.hpp>

#endif