CVE-2021-39286 (HTML, published 2021-08-18T18:15Z)
Description: value: Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/webrecorder/pywb
Files changed:
CHANGES.rst
config.yaml
docs/manual/access-control.rst
docs/manual/localization.rst
pywb/manager/locmanager.py
pywb/rewrite/templateview.py
pywb/templates/base.html
pywb/templates/error.html
pywb/templates/frame_insert.html
pywb/templates/head_insert.html
pywb/templates/header.html
pywb/templates/index.html
pywb/version.py
setup.py
tests/test_auto_colls.py
Commit message: Localization / doc fixes (#650)

* localization / doc fixes:
- add missing header.html
- docs: support 'i18n' extra, mention in docs
- use 'default_locale' for html lang tag
- access control docs: fix documentation for adding user with acl command

* localization: add compile_catalog after extract as well to simplify updates for identity (en) locale

* ui: 
- include locale in home page collection listing
- keep locale on error page home link

* autoescape:
- ensure jinja2 templates are autoescaped to prevent xss issues (thanks @sebastian-nagel for suggested fix)
- ensure banner inserts are not double-escaped
- update tests for template autoescaping

* update CHANGES.rst

* bump version to 2.6.0b1



Vulnerable code:
locales:
  - en
  - es
  wb-manager acl add <collection> http://httpbin.org/anything/something allow_ignore_embargo staff
from jinja2 import Environment, TemplateNotFound, contextfunction
<html lang="{{ env.pywb_lang | default('en') }}">
            <p><a href="/">{{ _('See list of valid collections') }}</a></p>
                    <a href="{{ env['pywb.app_prefix'] + '/' + route }}">{{ '/' + route }}</a>
__version__ = '2.6.0b0'
        print(resp.text)
        assert '"some":"value"' in resp.text, resp.text
        assert '"some":"value"' in resp.text

Fixed code:
pywb 2.6.0b1 changelist
~~~~~~~~~~~~~~~~~~~~~~~

Additional documentation / localization fixes `#650 <https://github.com/webrecorder/pywb/pull/650>`_

* Ensure home page and error page keeps locale, language switching is working.

* Add autoescaping to Jinja2 to avoid XSS issues (suggested by @sebastian-nagel)

* Add support for 'pywb[i18n]' extra to install localization dependencies

Documentation typo fixes (by @ldko, `#649 <https://github.com/webrecorder/pywb/pull/649>`_)


  wb-manager acl add <collection> http://httpbin.org/anything/something allow_ignore_embargo -u staff
To ensure all localization related dependencies are installed, first run::

  pip install pywb[i18n]


        self.compile_catalog()

from jinja2 import Environment, TemplateNotFound, contextfunction, select_autoescape
                                                  autoescape=select_autoescape(),
                                       autoescape=select_autoescape(),
<html lang="{{ env.pywb_lang | default(default_locale) }}">
            <p><a href="/{{ env.pywb_lang | default('') }}">{{ _('See list of valid collections') }}</a></p>
{% autoescape false %}

{% endautoescape %}

{% autoescape false %}

{% endautoescape %}

<header>
   {% if locales|length > 1 %}
    <div class="language-select">
        {{ _('Language:') }}
        <ul role="listbox" aria-activedescendant="{{ env.pywb_lang | default(default_locale) }}" aria-labelledby="{{ _('Language select') }}">
        {% for locale in locales %}
          <li role="option" id="{{ locale }}"><a href="{{ switch_locale(locale) }}">{{ locale }}</a></li>
        {% endfor %}
        </ul>
    </div>
    {% endif %}
</header>

                    <a href="{{ env['pywb.app_prefix'] + ('/' + env.pywb_lang if env.pywb_lang else '') + '/' + route }}">{{ '/' + route }}</a>
__version__ = '2.6.0b1'
    extras_require={
        "i18n":  ["translate_toolkit"],
    },
        #assert '"some":"value"' in resp.text, resp.text
        assert '{&#34;some&#34;:&#34;value&#34;}' in resp.text, resp.text
        #assert '"some":"value"' in resp.text
        assert '{&#34;some&#34;:&#34;value&#34;}' in resp.text, resp.text