yarr RSS reader iframe check allows javascript: XSS
Original title: XSS in yarr RSS reader
A whitelisted host after javascript:// can hide script that runs when a subscriber opens the malicious post.
A write-up describes cross-site scripting in yarr, an open-source Go RSS reader. Feed HTML is sanitized before it is returned as JSON and rendered, and iframe is an allowed tag with src permitted for a domain whitelist or the feed’s own host. Go’s URL parser treats the authority of javascript://www.youtube.com as a whitelisted host, while the browser executes the remainder as JavaScript. Default iframe sandbox attributes include allow-scripts, allow-same-origin, and allow-popups. The author says a malicious feed can script any user who loads the post and that maintainers were notified.
Unconfirmed: The post is cut off after saying maintainers were notified, so a fix is not confirmed.
- The iframe src whitelist includes YouTube, Vimeo, SoundCloud, Bandcamp, and several other media hosts.
- The demonstrated payload uses a newline so the host becomes a JavaScript comment.
- No fixed version is named in the published portion of the post.
Impact: Cross-site scripting in the browser of a yarr user
| Product | Affected |
|---|---|
| yarr | — |
From the original article
5 min read at 0x67673068.me
Note: The dark mode of this site is kind of hard to read. Comments
By 0x67673068.me via zk · 0x67673068.me
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.