XSS + html rendering

[mobasi-team]

Hi all,

Posting this here (though if there's a better place let us know).

We want to help with the XSS html rendering points we highlighted that are in aleapp, ileapp, etc. However, this would be a big code change for the maintainers to review. We want to brainstorm the best way to do this.

We can ship a large 2k line pr that patches this in a short term way, or we (maintainers + mobasi) can also work through a design pattern that'll simplify things for the leapps at large.

Leapp-core

For example, there could be a "leapp-core" package that all leapps all use. That place could centralize the leapp logic, UI, etc., such that aleapp, ileapp, etc. become about a repository of python artifacts, and the scaffolding and running of the artifacts is one single repo used by all.

This would make it easier to try performance, UI/UX changes, try alternative parsing backends, say, for example, if the maintainers ever wanted to migrate over to Rust, and it would help with code duplication across the two repositories.

We'd love to hear the maintainers' thoughts on this. Also down to discuss this in another forum.

[stark4n6]

@mobasi-team standardization of core code has been in works for some time, mostly by @Johann-PLW. We've been also been mulling a GUI overhaul for some time

[mobasi-team]

If you'd like our help with either/both efforts, we're happy to help accelerate it! just let us know

[JamesHabben]

The core across the LEAPPs is close but not quite close enough for a central core just yet. Slight variations of things have creeped in over the years so it's taken some time to unify the core.

On top of that, we are making improvements to the core that will help to unify but it's taken some time to get that replicated to the others. iLEAPP has been the primary repo on forward moving dev work in the core. You will see a lot of newer stuff in there.

It's slow moving for a lot of reasons. One of which is all of us doing this as volunteers on a side project, but another big one is to ensure validation of everything while introducing changes and improvements. In the spirit of forensics, we are trying to be as careful as possible to prevent inaccuracies in results.

Having a central core repo for framework code is an option, but as you said it would be a very large effort and shift from current state.

Also a note: the HTML output will be deprecated soon once we have feature parity in the electron app called LAVA, which is in private alpha stages right now.

[mobasi-team]

got it, all makes sense.

Then what do you all think is best:

1. us send a PR that hot patches xss in the html?
2. wait for LAVA support?

Also, not sure I've seen the LAVA code, but if it renders html (given it's an electron app), it could also have the same xss issue. Just want to flag

[JamesHabben]

The LAVA code is private for now, but the app will be released free. It does not have the same HTML escape issues, because the approach of LEAPPs in general is shifting to be only data parsing and to stay out of anything in the presentation layer. You can see this shift in the iLEAPP core code that relates to LAVA output. It declares types of data, but there's no ability to give opinion on how that data is rendered. React provides a lot of protections against these injection paths, given one doesn't purposefully disable them :)

The current HTML files are static-ish. They run planned JavaScript code, and could allow JavaScript to be injected; however being they are viewed in browsers as local files, they aren't considered to even have a site/domain and modern browsers won't even let JavaScript get to a sibling HTML file right beside the current file let alone pull data from any URL. XSS is not a thing with this output unless someone were to put them on a web server. JavaScript injection could happen, but impact is extremely limited to basic rendering. This is actually the primary reason for moving to LAVA.

There are quite a few modules that leverage the LEAPP HTML escape functions to control formatting in the HTML output. Do you have a solution that allows that to continue or will it break those modules?

[mobasi-team]

@JamesHabben do you have an email where we can privately disclose PoC of XSS?

good to hear on using React for the escaping!

on html escape, it's a big 2k line pr... if previous leapps are to be deprecated soon, it may not be worth this patch

you can also reach out to us at security at our domain and we can reply on that thread

[JamesHabben]

I have seen the previously shared doc and video related to this HTML. If the patch is 2k lines, then I agree with you this may not be worth the effort. The HTML has served its time and should be celebrated as it fades away.

[mobasi-team]

sounds good! I'll close this seeing as lava will be fixing the xss soon

[mobasi-team]

@JamesHabben @stark4n6 please see the email we just sent