Stored XSS via unescaped filenames in upload handlers

[anon87111]

Security: Stored XSS via unescaped filenames in upload handlers (9+ controllers)

Commit: 1a00ac50ff71d2841624d587003c0fd538b301f6

Summary

Commit 1a00ac5 removes HtmlEscape.escape() from filename handling across 9 controllers. User-supplied filenames are now returned unescaped in JSON upload responses, and KindEditor's afterUpload callback inserts the title field via innerHTML, completing a stored XSS chain.

Affected files (17 removals across 9 controllers)

The alert that flagged this only identified 2 files. The actual scope is:

Controller	Fields affected
AnswerFormAction.java	fileName, sourceFileName
CommentFormAction.java	fileName, sourceFileName
QuestionFormAction.java	fileName, sourceFileName
TopicFormAction.java	fileName, sourceFileName ×3
HelpManageAction.java	fileName, sourceFileName
MembershipCardManageAction.java	fileName, sourceFileName
ReportFormAction.java	ext
AnswerManageAction.java	fileName, sourceFileName
QuestionManageAction.java	fileName, sourceFileName

Confirmed JSON reflection endpoints

These controllers put the unescaped filename directly into the JSON response title field:

• /user/control/topic/upload — TopicFormAction
• /admin/help/upload — HelpManageAction
• /admin/membershipCard/upload — MembershipCardManageAction
• /admin/question/upload — QuestionManageAction

Attack chain

1. Authenticated user uploads a file with filename: "><img src=x onerror=alert(document.cookie)>.jpg
2. Server returns unescaped JSON (escaping was removed in this commit):

{"error": 0, "url": "...", "title": "><img src=x onerror=alert(document.cookie)>.jpg"}

3. KindEditor's afterUpload callback inserts data.title via innerHTML:

var html = '<div class="ke-file"><span>' + data.title + '</span></div>';
fileList.innerHTML += html;  // payload executes here

4. Script executes in the victim's browser — session cookies exfiltrated

Verification

Confirmed end-to-end with a local DOM test: "><img src=x onerror=alert(1)>.jpg fires alert(1) when processed by the KindEditor innerHTML rendering path. The <script> tag variant is blocked by browsers per spec but event-handler payloads execute without restriction.

KindEditor's innerHTML-based file listing is a known XSS vector — see CVE-2021-42227 / GHSA-wv83-jrfh-rp33.

Fix

Restore the removed HtmlEscape.escape() calls. They were present for exactly this reason. Simplest fix per controller:

// Restore these lines that were removed in commit 1a00ac5
fileName = HtmlEscape.escape(fileName);
sourceFileName = HtmlEscape.escape(sourceFileName);

Alternatively, escape at the KindEditor layer before innerHTML assignment, but fixing it server-side covers all rendering contexts including any future frontend changes.

[diyhi]

经核实，该现象仅存在于用户上传文件后的即时 JSON 回显中。需通过抓包工具手动篡改自身上传请求的 filename 字段方可触发。由于该回显仅针对上传者本人，无法形成针对其他用户或管理员的攻击链路，不具备传播性。

后端系统具备严格的输入审计。所有发帖提交内容在进入数据库前，均已通过 XSS 过滤组件 处理。数据库内存储的文件名均为安全过滤后的文本或系统生成的唯一 ID，不存在存储型 XSS 漏洞。

为进一步提升系统健壮性，消除回显时的显示歧义，巡云轻论坛 7.0 版本已在文件上传控制器（Controller）中引入了对原始文件名的 HTML 转义处理。