CVE-2013-0256 (Other, published 2013-03-01T05:40Z)
Description: value: darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rdoc/rdoc
Files changed:
CVE-2013-0256.rdoc
History.rdoc
Manifest.txt
Rakefile
lib/rdoc.rb
lib/rdoc/generator/template/darkfish/js/darkfish.js
Commit message: Fix CVE-2013-0256, an XSS exploit in RDoc

See CVE-2013-0256 for details on the exploit including a patch you can
apply to generated RDoc output.


Vulnerable code:
=== 4.0.0.preview3.1 / ??
  VERSION = '4.0.0.preview3.1'
  $("a[name=" + anchor + "]").each( function() {
    if ( !$(this).parent().parent().hasClass('target-section') ) {
      console.debug( "Wrapping the target-section" );
      $('div.method-detail').unwrap( 'div.target-section' );
      $(this).parent().wrap( '<div class="target-section"></div>' );
    } else {
      console.debug( "Already wrapped." );

Fixed code:
= RDoc 2.3.0 through 3.12 XSS Exploit

RDoc documentation generated by rdoc 2.3.0 through rdoc 3.12 and prereleases up
to rdoc 4.0.0.preview2.1 are vulnerable to an XSS exploit.  This exploit may
lead to cookie disclosure to third parties.

The exploit exists in darkfish.js which is copied from the RDoc install
location to the generated documentation.

RDoc is a static documentation generation tool.  Patching the library itself
is insufficient to correct this exploit.  Those hosting rdoc documentation will
need to apply the following patch.  If applied while ignoring whitespace, this
patch will correct all affected versions:

  diff --git darkfish.js darkfish.js
  index 4be722f..f26fd45 100644
  --- darkfish.js
  +++ darkfish.js
  @@ -109,13 +109,15 @@ function hookSearch() {
   function highlightTarget( anchor ) {
     console.debug( "Highlighting target '%s'.", anchor );
   
  -  $("a[name=" + anchor + "]").each( function() {
  -    if ( !$(this).parent().parent().hasClass('target-section') ) {
  -      console.debug( "Wrapping the target-section" );
  -      $('div.method-detail').unwrap( 'div.target-section' );
  -      $(this).parent().wrap( '<div class="target-section"></div>' );
  -    } else {
  -      console.debug( "Already wrapped." );
  +  $("a[name]").each( function() {
  +    if ( $(this).attr("name") == anchor ) {
  +      if ( !$(this).parent().parent().hasClass('target-section') ) {
  +        console.debug( "Wrapping the target-section" );
  +        $('div.method-detail').unwrap( 'div.target-section' );
  +        $(this).parent().wrap( '<div class="target-section"></div>' );
  +      } else {
  +        console.debug( "Already wrapped." );
  +      }
       }
     });
   };

RDoc 3.9.5, 3.12.1 and RDoc 4.0.0.rc.2 and newer are not vulnerable to this
exploit.

This exploit was discovered by Evgeny Ermakov <corwmh@gmail.com>.

This vulnerability has been assigned the CVE identifier CVE-2013-0256.

=== 4.0.0.rc.2 / ??
  * Fixed an XSS exploit in darkfish.js.  This could lead to cookie disclosure
    to third parties.  See CVE-2012-0256.rdoc for full details including a
    patch you can apply to generated RDoc documentation.
CVE-2013-0256.rdoc
    CVE-2013-0256.rdoc
  VERSION = '4.0.0.rc.2'
  $("a[name]").each( function() {
    if ( $(this).attr("name") == anchor ) {
      if ( !$(this).parent().parent().hasClass('target-section') ) {
        console.debug( "Wrapping the target-section" );
        $('div.method-detail').unwrap( 'div.target-section' );
        $(this).parent().wrap( '<div class="target-section"></div>' );
      } else {
        console.debug( "Already wrapped." );
      }