openwallet-foundation / acapy-vc-authn-oidc / 26128518885

92%

push

github

Enhance security by preventing XSS and open redirects (#1047)

* fix(security): prevent XSS via jinja2 autoescape and tojson in JS contexts (CWE-79)

- Replace jinja2.Template (autoescape off) with Environment(autoescape=True)
  in oidc.py to HTML-escape all template variable output
- Use tojson filter for wallet_deep_link and pid values injected into
  JavaScript in verified_credentials.html to prevent JS string injection
- Use context manager for template file open to prevent file handle leak

Signed-off-by: Emiliano Suñé <2395873+esune@users.noreply.github.com>

* fix(security): prevent open redirect via URL validation in callback (CWE-601)

Validate response_url before issuing RedirectResponse in get_authorize_callback:
- Reject any URL whose scheme is not http or https (e.g. javascript:, data:)
- Resolve the client_id from the stored request_parameters and look up the
  registered redirect_uris; reject the redirect if the base URL (scheme +
  host + path) does not match any registered entry
- Defense-in-depth: PyOP already validates redirect_uri at auth-request time;
  this check closes the window in case response_url is tampered at the DB level

Signed-off-by: Emiliano Suñé <2395873+esune@users.noreply.github.com>

* fix(security): enable jinja2 autoescape and fix JS injection in remaining routes (CWE-79)

presentation_request.py and verificationConfigs/router.py both used
jinja2.Template directly, which disables HTML auto-escaping by default,
allowing any DB-sourced or user-controlled value to be reflected as raw
HTML in the response.
- Replace jinja2.Template with Environment(loader=BaseLoader(), autoescape=True)
  in presentation_request.py and verificationConfigs/router.py
- Use context manager (with open) for template file reads in both files
- In wallet_howto.html, replace raw "{{wallet_deep_link}}" in JS assignment
  with {{wallet_deep_link|tojson}}: HTML-escaping is incorrect in a JS string
  context (e.g. '&' → '&amp;' breaks URLs);... (continued)

21 of 27 new or added lines in 3 files covered. (77.78%)

2466 of 2671 relevant lines covered (92.32%)

0.92 hits per line