{"action":"closed","issue":{"url":"https://api.github.com/repos/sferik/rails_admin/issues/2343","labels_url":"https://api.github.com/repos/sferik/rails_admin/issues/2343/labels{/name}","comments_url":"https://api.github.com/repos/sferik/rails_admin/issues/2343/comments","events_url":"https://api.github.com/repos/sferik/rails_admin/issues/2343/events","html_url":"https://github.com/sferik/rails_admin/issues/2343","id":90377574,"number":2343,"title":"XSS vulnerability in association fields","user":{"login":"Centine","id":832222,"avatar_url":"https://avatars.githubusercontent.com/u/832222?v=3","gravatar_id":"","url":"https://api.github.com/users/Centine","html_url":"https://github.com/Centine","followers_url":"https://api.github.com/users/Centine/followers","following_url":"https://api.github.com/users/Centine/following{/other_user}","gists_url":"https://api.github.com/users/Centine/gists{/gist_id}","starred_url":"https://api.github.com/users/Centine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Centine/subscriptions","organizations_url":"https://api.github.com/users/Centine/orgs","repos_url":"https://api.github.com/users/Centine/repos","events_url":"https://api.github.com/users/Centine/events{/privacy}","received_events_url":"https://api.github.com/users/Centine/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/sferik/rails_admin/labels/confirmed%20bug","name":"confirmed bug","color":"e10c02"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-06-23T12:43:48Z","updated_at":"2015-06-26T08:38:07Z","closed_at":"2015-06-26T08:38:07Z","body":"It seems possible to inject Javascript code through associations. I have a model in Mongo with embedded documents. Below is an example with javascript in the fields.\r\n\r\n    {\r\n\t\"_id\" : ObjectId(\"001\"),\r\n\t\"name\" : \"\\\"><img src=x onerror=prompt(3)>\",\r\n\t\"profiles\" : [\r\n\t\t{\r\n\t\t\t\"_id\" : ObjectId(\"002\"),\r\n\t\t\t\"contact\" : \"\\\"><img src=x onerror=prompt(4)>\",\r\n\t\t\t\"name\" : \"\\\"><img src=x onerror=prompt(6)>\",\r\n\t\t\t\"notes\" : \"\\\"><img src=x onerror=prompt(5)>\",\r\n\t\t\t\"updated_at\" : ISODate(\"2015-06-23T10:15:12.279Z\")\r\n\t\t}\r\n\t]\r\n    }\r\n\r\n\r\nUpon viewing or editing the '001' document in rails_admin, a Javascript popup is shown with the value 6. It seems this value is used in several places, both under \"show\" and \"edit\" where it is used as tab title. \r\nSimply removing the trailing .html_safe call in lib/rails_admin/config/fields/association.rb:pretty_value obviously breaks existing functionality."}}